Information

also from the

authority.

9. November 2026

by

Clemens Pfitzer

Anyone who files a complaint with the data protection authority discloses their own data in the process. Is the supervisory authority then obligated to disclose what information it has on file about the complainant? And what does the complainant learn in this way about the company that is the subject of their complaint?

A journalist wants to see his complaint file

The complainant is a journalist and runs a blog that deals, among other topics, with data protection. Since 2021, he had filed several complaints with the Bavarian State Office for Data Protection Supervision. On May 13, 2022, he filed another complaint against a company. The State Office found violations and informed him on October 11, 2022, that any further violations would result in a warning subject to a fee.

That was not enough for the journalist. That same day, he requested information about all the data the State Office had processed regarding him during the complaint proceedings, along with copies. The State Office denied the request on October 20, 2022. It cited the Bavarian Data Protection Act, which states that there are no rights to information or access regarding files and records held by supervisory authorities.

The journalist filed a lawsuit on December 6, 2022, with the Ansbach Administrative Court. On February 23, 2024, the State Office granted him electronic access to the case files, but expressly without acknowledging any legal obligation to do so. Since then, the case has revolved solely around establishing that the denial was unlawful. The Administrative Court referred the matter to the European Court of Justice by order dated February 19, 2025.

Supervisor or Data Controller?

The State Office maintained a clear separation of roles. In its dealings with the complainant, it acted exclusively as a supervisory authority. It is not the controller within the meaning of the General Data Protection Regulation—that is, the entity that determines the purposes and means of data processing and must therefore fulfill the rights of data subjects—in this relationship. The referring court, however, tended to take the view that a public authority could be both at the same time.

The ECJ also requires the supervisory authority to provide information

The ECJ ruled in favor of the complainant on both questions referred for a preliminary ruling (ECJ Judgment of November 5, 2026 – Case No. C-205/25). A supervisory authority handling a complaint is the controller of the complainant’s data and is, in principle, obligated to provide the complainant with information. A state regulation that completely precludes such disclosure violates the General Data Protection Regulation.

Why is the supervisory authority also the data controller?

Whoever handles a complaint processes the complainant’s data. In the Court’s view, the authority collects, stores, retrieves, and uses this data. The purpose and means of this processing arise essentially from Union law, which governs the authority’s activities. This is sufficient for the authority to be classified as a data controller.

The Court justifies this primarily by pointing to the consequences of the opposing view. Without this classification, the complainant would have no data subject rights vis-à-vis the authority—neither the right to access, nor to rectification, nor to erasure. Furthermore, the authority would not be bound by the principles of data processing. The State Office’s argument that the regulation strictly separates the supervisory authority from the data controller did not convince the Court. This separation merely describes the standard case.

One important caveat is that the right to information does not establish a general right to access official records. It applies to one’s own personal data and information regarding its processing, not to all of the agency’s documents.

Why doesn’t the blanket exclusion hold up?

The General Data Protection Regulation allows member states to restrict the rights of data subjects by law. However, this is only permissible if the restriction serves one of the public interest objectives listed therein, respects the essence of fundamental rights, and is proportionate. The State Office had invoked the protection of third parties, its operational capacity and independence, as well as public safety. According to the ruling, none of these objectives justifies a complete exclusion.

Protection of Third Parties: While the rights of other individuals are a legitimate goal, they should not result in the refusal to disclose any information. The conflicting interests must be weighed.

Operational effectiveness and independence. This objective is generally recognized. However, it is not clear how the provision of information could undermine the authority’s independence. Member States must offset the administrative burden by providing the authorities with sufficient resources. The Regulation itself provides remedies against manifestly unfounded or excessive requests, namely a fee or a refusal. We have outlined when a request may be considered abusive in our article on the threshold for abusive GDPR requests.

Public safety. This justifies a restriction only in the event of an actual and sufficiently serious threat to a fundamental interest of society. The case file revealed no such threat.

What does this mean for your own data access processes?

The provisions regarding the protection of third parties do not apply only to government agencies. They apply to any company that responds to requests for information. In this regard, the Court of Justice draws on its previous case law. According to this, completely refusing to provide information on the grounds that it refers to data from colleagues, customers, or business partners is hardly tenable. What is required is a case-by-case assessment and, where possible, disclosure with redactions.

The technology used is key here. A black bar in a PDF is not always an effective redaction, as we discussed in our article “Redaction, but Done Right.”

What does the complainant learn about your company?

For companies that are the subject of a complaint, a follow-up question arises. The agency’s file typically contains its statements and documents. The ruling does not explicitly address which parts of the file may be disclosed to the complainant under the right to access information.

According to the ruling, the complainant is not entitled to the entire file. However, to the extent that a statement from the company contains information about him—such as regarding his orders, his correspondence, or his conduct—this information is likely to constitute his personal data. It may then be subject to disclosure. Data pertaining to employees or third parties would need to be redacted. The Regulation explicitly mentions trade secrets as deserving of protection in its recitals. How authorities will balance these interests in practice remains to be seen.

We therefore recommend the following steps when submitting statements to the supervisory authority:

• Keep your language objective. Assume that passages about the complainant may be shared with him or her later. Personal judgments about the complainant do not belong in the statement.
• Separate. Keep discussions of internal procedures and security measures separate from information regarding the complainant’s personal details.
• Identify. Explicitly mark trade secrets and third-party data, and justify the need for protection.
• Have it reviewed. In proceedings with recognizable potential for conflict, have statements reviewed in advance by a data protection law consultant.

Conclusion

We’d be happy to

advise you on

Data protection law!

Contact Form

Call now!