CJEU - C‑414/24 - Datenschutzbehörde (Articulation des recours)
| CJEU - C‑414/24 Datenschutzbehörde (Articulation des recours) | |
|---|---|
 | |
| Court: | CJEU |
| Jurisdiction: | European Union |
| Relevant Law: | Article 77(1) GDPR Article 78(1) GDPR Article 79(1) GDPR |
| Decided: | 04.09.2025 |
| Parties: | |
| Case Number/Name: | C‑414/24 Datenschutzbehörde (Articulation des recours) |
| European Case Law Identifier: | ECLI:EU:C:2025:656 |
| Reference from: | VwGH (Austria) |
| Language: | 24 EU Languages |
| Original Source: | AG Opinion Judgement |
| Initial Contributor: | ap |
The CJEU held that a supervisory authority cannot reject a complaint under Article 77(1) GDPR on the sole ground that judicial proceedings under Article 79(1) GDPR have already been brought concerning the same subject matter.
English Summary
Facts
In 2017 (before the GDPR entered into force), a data subject requested an online physician search platform (the controller) to erase their data. The controller refused, and the data subject brought a claim before a civil court. The data subject requested the controller to erase their data again after the GDPR had entered into force. This request was refused, and the data subject filed a complaint with the Austrian DPA. The DPA dismissed the complaint, on the grounds that they had previously brought the same matter before a court. According to the DPA, filing parallel or consecutive claims with a supervisory authority and a court was incompatible with the remedial mechanism under the GDPR. At the time, the civil court had not reached a final decision.
The data subject appealed the decision to the Federal Administrative Court (Bundesverwaltungsgericht, or BVwG), who dismissed the appeal. The BVwG stated that the one-year limitation period under Austrian law had passed, and therefore, the data subject did not have the right to file a complaint with the DPA. The fact that the GDPR had entered into force did not interrupt the limitation period.
Both the data subject and the DPA appealed the decision of the Court to the Supreme Administrative Court (Verwaltungsgerichtshof, or VwGH). The VwGH disagreed with the reasoning of the BVwG; the limitation period only started after the controller rejected the data subject’s second erasure request, after the GDPR had entered into force. The VwGH stayed proceedings and requested a preliminary ruling from the CJEU. The question was based on the Case C-132/21, in which the CJEU held that the right to lodge a complaint with a supervisory authority (Articles 77(1) and 78(1) GDPR) may be exercised independently from the right to a judicial remedy against a controller or processor (Article 79(1) GDPR). The VwGH requested the CJEU to clarify the relationship between the remedies, and specifically, whether a DPA can reject a complaint on the grounds that the data subject has initiated judicial proceedings on the same subject.
The Court referred the following questions:
1. Are Articles 77 and 79 of [the GDPR] to be interpreted, in the light of the findings of the Court in the judgments [in Nemzeti Adatvédelmi és Információszabadság Hatóság] and [SCHUFA Holding], as meaning that the possibility provided by national law for the rejection of a complaint lodged with a supervisory authority under Article 77 of the GDPR on the ground that a judicial remedy has already been sought in the same case under Article 79 of the GDPR and that the action is pending before the court [in question] constitutes a permissible arrangement for regulating the relationship between those remedies within the meaning of the abovementioned case-law of the Court?
2. If the answer to the first question is in the negative, are Articles 77 and 79 of [the GDPR] to be interpreted, in the light of the findings of the Court in the judgments [in Nemzeti Adatvédelmi és Információszabadság Hatóság] and [SCHUFA Holding], as meaning that the possibility provided by national law for the rejection of a complaint lodged with a supervisory authority under Article 77 of the GDPR on the ground that a substantive judgment (even if not yet final) has already been made in the pending proceedings in the same case on the judicial remedy under Article 79 of the GDPR constitutes a permissible arrangement for regulating the relationship between those remedies within the meaning of the abovementioned case-law of the Court?’
Advocate General Opinion
AG De la Tour examined both questions together.
The AG first considered the wording of the GDPR provisions: both Articles 77(1) and 78(1) GDPR, as well as 79(1) GDPR offer different remedies without prejudice to the other remedies. The remedies coexist independently, because the EU legislator intended to provide data subjects with a high level of protection regarding their right to data protection, and guarantee access to an effective judicial remedy.
The AG referred to his previous opinion in C-132/21, where he stated that allowing a DPA to reject a complaint on the basis that judicial proceedings on the same matter had already been brought would undermine the right of data subjects to bring parallel actions on the same processing of personal data. However, the AG also pointed out the risk of legal uncertainty caused by two contradictory decisions within a Member State; while contradictory decisions between Member States were regulated by the GDPR, the AG concluded that it was the responsibility of each member State to ensure there are no contradictory decisions within a Member State regarding the same processing of personal data. These procedural rules, however, must be implemented in line with the principles of equivalence and effectiveness.
According to the AG, a possible solution for Member States is to provide the option or obligation of DPAs and courts to stay proceedings pending before it until a decision has been taken by another DPA or court. In this case, the DPA should be allowed to suspend the investigation of the data subject’s complaint until the decision of the civil court is final. The AG noted that the decision of the DPA to reject the complaint may not necessarily be an appropriate measure to avoid contradictory decisions. The DPA cannot be certain that the court will decide on the merits in its proceedings as it may dismiss the claim on procedural grounds.
Finally, the AG highlighted the importance of supervisory authorities’ role in safeguarding data subjects’ right to protection of their personal data. Rejecting a complaint automatically on the basis that there are ongoing judicial proceedings on the same matter would be contrary to its duty of diligence.
The AG concluded that both questions should be answered in the negative, meaning the DPA may not reject a complaint on the grounds that judicial proceedings concerning the same matter have already been brought if said proceedings are not yet final.
Holding
The CJEU examined the two questions together and answered both of them in the negative. The Court held that a supervisory authority may not reject a complaint under Article 77(1) GDPR on the sole ground that judicial proceedings concerning the same subject matter have already been brought under Article 79(1) GDPR. According to the CJEU, the same applies if the substantive decision given in those proceedings is not yet final.
First, the CJEU pointed out that making several remedies available helps guarantee the data subject the right to an effective judicial remedy within the meaning of Article 47 of the Charter. The Court referred to its previous case law and stated that Articles 77, 78, and 79 GDPR all offer different remedies that must be capable of being exercised without prejudice to the others. As the GDPR does not establish any rule of precedence between these remedies, they may be exercised concurrently with and independently of each other.
Second, the CJEU emphasised the objectives of the GDPR and held that the goal of ensuring a high level of protection of the rights of data subjects supported its interpretation of Articles 77 and 79. The Court pointed out that the exact relationship between the legal remedies in the Member States depends on national legislation, which has to comply with the principles of equivalence and effectiveness.
Third, the CJEU took into account that the possibility to reject the complaint due to ongoing judicial proceedings would help to avoid adopting contradictory decisions in the same case and thus strengthen legal certainty. However, such a relationship between the remedies would lead to the data subject being deprived of any effective protection where their judicial proceedings are dismissed on procedural grounds without a decision being given on the merits. Allowing the rejection of the complaint would therefore be contrary to the principle of effectiveness.
Against this background, the CJEU referred to the possibility of the Member States to envisage a suspension mechanism as suggested by the Advocate General in his opinion. Under such a mechanism, the supervisory authority handling the complaint could suspend the proceedings until a court decision definitively closes the dispute in question.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
