Opinion of the Advocate General — ECLI:EU:C:2026:312
Date: 2026-04-16
Language of the case: German

Translation C-205/25 – 1 
Case C-205/25 
Request for a preliminary ruling 
Date lodged: 
17 March 2025 
Referring court: 
Bayerisches Verwaltungsgericht Ansbach (Germany) 
Date of the decision to refer: 
19 February 2025 
Applicant: 
Joachim Lindenberg 
Defendant: 
Bayerisches Landesamt für Datenschutzaufsicht 
      
[…] 
AN 14 K 22.02562 
Bayerisches Verwaltungsgericht Ansbach (Bavarian Administrative Court, 
Ansbach, Germany) 
In the administrative proceedings 
Joachim Lindenberg  
[…] Karlsruhe 
– Applicant – 
[…] 
v 
Bayerisches Landesamt für Datenschutzaufsicht  
[…] Ansbach 
– Defendant – 
EN 
REQUEST FOR A PRELIMINARY RULING OF 19. 2. 2025 – CASE C-205/25 
 
2  
Anonymised version 
concerning 
data protection law 
the Bavarian Administrative Court, Ansbach, 
[…] 
on 19 February 2025 
has made the following 
Order: 
I. The following questions are referred to the Court of Justice of the European 
Union for a preliminary ruling pursuant to Article 267 TFEU: 
1. Is Article 15 of Regulation (EU) 2016/679, read in conjunction with 
Article 4(7) of Regulation 2016/679, to be interpreted as meaning that 
a supervisory authority, as defined in Article 4(21) of Regulation 
2016/679 and acting in the context of a complaint procedure initiated 
by a data subject pursuant to Article 77 of Regulation 2016/679, is at 
the same time a ‘controller’ within the meaning of Article 15 of 
Regulation 2016/679, read in conjunction with Article 4(7) of 
Regulation 2016/679, and is therefore required to grant the data subject 
access to information on the basis of Article 15 of Regulation 
2016/679? 
2. If Question 1 is answered in the affirmative: Is EU law, in particular 
Article 23 of Regulation 2016/679, to be interpreted as precluding 
national legislation – such as Article 20(2) of the Bayerisches 
Datenschutzgesetz (Bavarian Law on Data Protection), the provision at 
issue in the main proceedings – which excludes, in a blanket manner, 
rights of access or inspection with respect to files and records of 
supervisory authorities as defined in Article 4(21) of Regulation 
2016/679? 
II. […] [Stay of proceedings] 
Grounds: 
A. Subject matter and facts of the main proceedings 
I. Subject matter of the dispute and facts of the case 
The applicant seeks to establish that the refusal of the defendant, the Bayerisches 
Landesamt für Datenschutzaufsicht (Bavarian Data Protection Authority; ‘the 
BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT 
 
3 
Anonymised version 
BayLDA’), to comply with a request for access made under Article 15 of 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1; ‘the 
GDPR’) was unlawful. 
The BayLDA monitors compliance with data protection law in the non-public 
sector in the Free State of Bavaria and, in its capacity as supervisory authority, is 
therefore the body competent, inter alia, for data protection complaints (Article 77 
of the GDPR) in Bavaria by private individuals against non-public entities. The 
applicant is a journalist and runs a blog that deals, inter alia, with data protection. 
Since 2021, the applicant has lodged a number of complaints with the BayLDA. 
Following a data protection complaint made by the applicant on 13 May 2022, the 
BayLDA initiated a supervisory complaint procedure against a third party. By 
email of 11 October 2022, the BayLDA informed the applicant that it had found 
data protection breaches by the respondent third party in this connection, stating 
that a warning with costs would be issued to the respondent in the event of further 
breaches after the deadline for implementing improvements had passed. By email 
of the same day, the applicant requested further details regarding the measures 
taken by the BayLDA. As the BayLDA did not comply with this request, the 
applicant requested full access to information pursuant to Article 15(1) and (3) of 
the GDPR by email of 11 October 2022. 
By email and decision of 20 October 2022, the BayLDA refused the request for 
access made pursuant to Article 15(1) and (3) of the GDPR, justifying that refusal 
on the basis that, in accordance with the express provisions of Article 20(2) of the 
Bayerisches Datenschutzgesetz (Bavarian Law on Data Protection; ‘the 
BayDSG’), there are no rights of access or inspection with respect to files and 
records of the supervisory authority. 
By means of a written submission from his authorised representative of 
6 December 2022, the applicant brought an action against that decision before the 
Bavarian Administrative Court, Ansbach, initially seeking an order requiring the 
BayLDA to provide the applicant with a copy of all the data in the file regarding 
the complaint procedure initiated on 13 May 2022. 
On 23 February 2024, the BayLDA granted electronic access to the file regarding 
the complaint procedure opened by the defendant without, however, recognising 
any legal obligation to do so. 
In the main proceedings, the applicant is now only seeking to establish that the 
BayLDA’s decision of 20 October 2022 refusing the applicant’s request for access 
was unlawful. 
REQUEST FOR A PRELIMINARY RULING OF 19. 2. 2025 – CASE C-205/25 
 
4  
Anonymised version 
II. Legal framework under national law 
The Bundesdatenschutzgesetz (Federal Law on Data Protection; ‘the BDSG’) 
provides inter alia: 
‘Paragraph 40 Supervisory authorities of the Länder 
(1) The authorities competent under Land law shall monitor the application by 
non-public entities of data protection legislation within the scope of Regulation 
(EU) 2016/679. …’ 
The BayDSG, legislation of the Free State of Bavaria which applies only in the 
Free State of Bavaria, provides inter alia: 
‘Article 10 Right of access by the data subject 
(regarding Article 15 of the GDPR) 
(1) 1The decision as to whether a person that has transmitted personal data to the 
public prosecutor’s office, the police, the tax office, supra-local auditing bodies, 
constitutional protection bodies, the Federal Intelligence Service, the Military 
Counterintelligence Service or other authorities of the Federal Ministry of 
Defence shall be granted access to information, shall be made by the controller in 
agreement with the bodies to which the data have been transmitted. 2This also 
applies to access to personal data transmitted to the controller by one of the bodies 
referred to in the first sentence. 
(2) Without prejudice to paragraph (1), access shall not be granted where: 
1. such access would be detrimental to the proper performance of security 
tasks, or the prevention, investigation, detection or prosecution of criminal 
offences, administrative offences or professional offences, or the execution 
of criminal penalties; 
2. such access would be detrimental to public security, public order, national 
defence or an important economic or financial interest of the Free State of 
Bavaria, another Land, Germany or the European Union, including 
monetary, budgetary and taxation matters; 
3. the personal data or the fact that the personal data have been stored must be 
kept secret for the protection of the data subject or overriding legitimate 
interests of third parties; 
4. the personal data are processed only for the purposes of data backup or data 
protection control, access to information would involve disproportionate 
effort and processing for other purposes is precluded by appropriate 
technical and organisational measures; or 
BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT 
 
5 
Anonymised version 
5. personal data are not processed by automated means nor form part of a filing 
system or are intended to form part of a filing system; and 
(a) the data subject provides no information that can be used to retrieve 
the data; or 
(b) the effort required to provide the information is disproportionate to the 
claimed interest in the information. 
(3) 1If access is not granted or is only granted to a limited extent: 
1. the reasons for this must be recorded; 
2. the data subject must be informed, stating the reasons, unless this would run 
counter to one of the purposes set out in points 1 to 3 of paragraph (2); and 
3. unrestricted access must be granted to the supervisory authority at the data 
subject’s request. 
2The supervisory authority may not communicate to the data subject, without the 
consent of the bodies referred to in the first sentence of paragraph (1), 
information enabling conclusions to be drawn as to the level of their 
knowledge. 
(4) …’ 
‘Article 18 
Establishment and functions 
(regarding Articles 51 to 58 and 85 of the GDPR) 
(1) 1The Bavarian Data Protection Authority (BayLDA) shall be the supervisory 
authority, pursuant to Article 51 of the GDPR and Paragraph 40 of the Federal 
Law on Data Protection, with respect to non-public entities. …’ 
‘Article 20 
Referral to the supervisory authority 
(regarding Article 77 of the GDPR) 
(1) 1Anyone may apply to the supervisory authority to claim that his or her 
rights have been infringed in the processing of his or her personal data. 2The data 
subject must suffer no disadvantage by virtue of referring a matter to the 
supervisory authority. 
(2) There shall be no rights of access or inspection with respect to the files and 
records of the supervisory authority.’ 
REQUEST FOR A PRELIMINARY RULING OF 19. 2. 2025 – CASE C-205/25 
 
6  
Anonymised version 
The explanatory memorandum (State Parliament document 17/19628, p. 42 et 
seq.) to Article 20 of the BayDSG reads as follows: 
‘The provision sets out in more detail the right to lodge a complaint provided for 
in Article 77 of the GDPR, which is already directly guaranteed by the GDPR, and 
the complaint procedure provided for in Article 52 of [Directive (EU) 2016/680 of 
the European Parliament and of the Council of 27 April 2016 on the protection of 
natural persons with regard to the processing of personal data by competent 
authorities for the purposes of the prevention, investigation, detection or 
prosecution of criminal offences or the execution of criminal penalties, and on the 
free movement of such data, and repealing Council Framework Decision 
2008/977/JHA (OJ 2016 L 119, p. 89; “the Law Enforcement Directive”)]. 
It thus contains Member State procedural rules on the basis of Article 58(4) of the 
GDPR or Article 47(4) of the Law Enforcement Directive. 
The provisions adopted in the second and third sentences of paragraph (1) and in 
paragraph (2), based on administrative practice and case-law regarding the 
previous right to lodge a complaint provided for in Article 9 of the (old version of 
the) BayDSG, make it clear that the data protection complaint procedure is to be 
equated with the parliamentary petition procedure (see, for more details, Wilde 
and Others, Datenschutz in Bayern, Article 9 of the BayDSG, paragraph 13). 
The legislation thus underlines, in the interests of effective data protection control 
in accordance with EU law, that the right to lodge a complaint guaranteed by the 
Charter of Fundamental Rights of the European Union confers an entitlement to a 
comprehensive review of the complaint lodged (cf. Court of Justice of the 
European Union of 6 October 2015, Case C-362/15), on the basis of which only 
an obligation on the part of the supervisory authority to conduct a proper 
investigation and, if necessary, to issue an appealable decision results (Nemitz in 
Ehmann/Selmayr, Datenschutz-Grundverordnung, Article 77, paragraph 12). 
Unlike in the supervision of building works and other supervisory triangular 
relationships, there is therefore no enforceable subjective right vis-à-vis public 
authorities to supervisory authority intervention. 
Regarding paragraph (2): 
Paragraph (2) restricts rights of access and inspection under data protection and 
other law. In so far as the provision restricts data subject rights established by the 
GDPR, it is supported by Article 23 of the GDPR. Overall, the provision 
underlines the special purpose limitation of the information obtained in the 
performance of data protection monitoring tasks. It therefore extends both to data 
subjects’ rights established by the GDPR and to other individual rights of access 
to information provided for by national law.’ 
Accordingly, the BayLDA is the supervisory authority under Article 51 of the 
GDPR with respect to non-public entities in the Free State of Bavaria. In its 
BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT 
 
7 
Anonymised version 
capacity as supervisory authority, it is therefore the body competent in Bavaria 
for, inter alia, data protection complaints brought by private citizens against non-
public entities. 
Article 20(2) of the BayDSG applies under all circumstances and, under national 
law, completely excludes any right of access under Article 15 of the GDPR where 
such a right is asserted against the BayLDA with respect to its files and records. 
Article 20(2) of the BayDSG also excludes rights of access and inspection with 
respect to files and records of the Bavarian Data Protection Officer – the 
supervisory authority under Article 51 of the GDPR that is competent for public 
bodies pursuant to the first sentence of Article 15(1) of the BayDSG. According to 
the court’s interpretation and in line with the practice of the BayLDA, the scope of 
Article 20(2) of the BayDSG is not limited to requests for access relating to files 
concerning complaint procedures under Article 77 of the GDPR, but also extends 
to data collected and processed in the context of the BayLDA’s other activities. 
The BayDSG does not contain any provisions allowing derogations from 
Article 20(2) of the BayDSG. 
B. Questions referred for a preliminary ruling and relevance to the resolution of 
the dispute 
I. Legal framework under European Union law 
The GDPR lays down the provisions of EU law that are central to the dispute. 
Primarily relevant are Article 4(7) and (21) of the GDPR, Article 15 of the GDPR 
together with recital 63 thereof, and Article 23 of the GDPR together with the 
associated recital 73 thereof. The second sentence of Article 8(2) of the Charter of 
Fundamental Rights is particularly relevant to the interpretation of Article 23 of 
the GDPR. 
II. Relevance of the questions referred for interpretation to the resolution of 
the dispute in the main proceedings 
Both questions regarding the interpretation of the GDPR are relevant to the 
resolution of the dispute in the main proceedings. 
If the first question is answered in the negative, then the applicant’s right of access 
under Article 15 of the GDPR vis-à-vis the BayLDA in the underlying context of 
a complaint procedure under Article 77 of the GDPR was already excluded under 
EU law and therefore the applicability of Article 20(2) of the BayDSG is 
irrelevant. 
If the first question is answered in the affirmative, the resolution of the dispute in 
the main proceedings depends on whether Article 20(2) of the BayDSG is 
precluded by virtue of the primacy of EU law. This is because, in the present case, 
REQUEST FOR A PRELIMINARY RULING OF 19. 2. 2025 – CASE C-205/25 
 
8  
Anonymised version 
the BayLDA was, under EU law, the entity against which a right of access was 
asserted by the applicant under Article 15 of the GDPR, who, as the (potential) 
data subject, was able to obtain, inter alia, access to their personal data 
(Article 4(1) of the GDPR), the presence of which in the requested complaint file 
being undisputed, whereas Article 20(2) of the BayDSG excluded that right. The 
court sees no indication that the request for access was made improperly in the 
sense of the second sentence of Article 12(5) of the GDPR. 
If the second question is answered in the negative, the BayLDA was entitled 
lawfully to invoke Article 20(2) of the BayDSG and refuse the applicant’s request 
for access; the action would have to be dismissed. 
If the second question is answered in the affirmative, the BayLDA was not 
entitled lawfully to invoke Article 20(2) of the BayDSG and refuse the applicant’s 
request for access. 
III. Uncertainties regarding the interpretation of European Union law 
1. Regarding Question 1: 
If a complainant – such as the applicant in the present case – lodges a complaint 
under Article 77 of the GDPR with a data protection supervisory authority – such 
as the BayLDA in the present case – that authority acts as the supervisory 
authority within the meaning of Article 4(21) of the GDPR vis-à-vis the 
complainant in the context of the complaint procedure. In some quarters, such a 
situation is considered to preclude the data protection supervisory authority from 
being the ‘controller’ in relation to the complainant for the purposes of Article 15 
of the GDPR, read in conjunction with Article 4(7) GDPR (the view held by 
Engelbrecht in Schröder, Bayerisches Datenschutzgesetz, 1st Edition 2021, 
BayDSG Article 20 paragraph 20; cf. also Munich Administrative Court, ruling of 
24 March 2021 – M 13 K 20.6765, 
ECLI:DE:VGMUENC:2021:0324.M13K20.6765.00 – juris paragraph 25), and 
thus a right of access on the part of the complainant as against the data protection 
supervisory authority, relating to personal data from the complaint procedure, is 
excluded from the outset. The BayLDA argues that the obligations of the 
supervisory authority in the context of a complaint procedure – and thus the rights 
of the complainant – are governed exhaustively by Articles 77 and 78 of the 
GDPR, and therefore recourse to the general rights of data subjects is precluded. 
The referring court, on the other hand, takes the view that a data protection 
supervisory authority can be a supervisory authority within the meaning of 
Article 4(21) of the GDPR and, at the same time, a controller and entity against 
which a right of access is asserted for the purposes of Article 15 of the GDPR, 
read in conjunction with Article 4(7) thereof. There is nothing to indicate that, 
within the framework of the GDPR, the EU legislature intended the data 
protection supervisory authority – which, by its very nature, must process personal 
data in the context of the complaint procedure – not to be the controller within the 
BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT 
 
9 
Anonymised version 
meaning of Article 15 of the GDPR and Article 4(7) of the GDPR, contrary to that 
framework. In particular, the purpose of Article 15 of the GDPR, namely of 
enabling a data subject to verify the lawfulness of data processing (cf. recital 63 
GDPR) can also be achieved by asserting a right of access against the data 
protection supervisory authority which, just like other authorities, is itself bound 
by data protection law. 
2. Regarding Question 2: 
The second question arises only if the first question is answered in the affirmative. 
In that case, the question which arises in the main proceedings is whether 
Article 20(2) of the BayDSG excluded the applicant’s right of access under 
Article 15 of the GDPR. 
a) 
The referring court has serious doubts as to whether such a blanket exclusion – in 
relation to the files and records of the supervisory authority – from the right of 
access provided for in Article 15 of the GDPR, as laid down in Article 20(2) of 
the BayDSG, meets the requirements set down in the opening clause of 
Article 23(1) of the GDPR. 
In the view of the referring court, taking into account recital 73 of the GDPR, it is 
questionable whether Article 20(2) of the BayDSG constitutes a necessary and 
proportionate measure in a democratic society to safeguard an objective listed in 
Article 23(1)(a) to (j) of the GDPR. 
The referring court doubts whether Article 20(2) of the BayDSG is even suitable 
for safeguarding an objective listed in Article 23(1)(a) to (j) of the GDPR. 
Although the explanatory memorandum expressly mentions Article 23 of the 
GDPR as the legal basis for Article 20(2) of the BayDSG, it does not refer to an 
objective listed therein. It is merely stated that, overall, the provision underlines 
the specific purpose of the information obtained in the performance of data 
protection monitoring tasks. The BayLDA argues as follows: In order to carry out 
their tasks effectively, data protection supervisory authorities are particularly 
dependent on being able to guarantee confidentiality to controllers and processors. 
Article 20(2) of the BayDSG also safeguards complainants’ legitimate 
expectations as regards confidentiality, since the right of access also exists with 
regard to controllers. Article 20(2) of the BayDSG is ultimately also an expression 
by the Member State of the obligation of confidentiality on the part of the 
members and staff of the supervisory authorities laid down in Article 54(2) of the 
GDPR. Furthermore, it maintains that the complete independence granted to the 
data protection supervisory authorities justifies an exemption from the right of 
access because a right of access would create a tension for the data protection 
supervisory authorities between the fulfilment of their independent supervisory 
role and the executive or private data processing bodies. Through those objectives, 
Article 23(1)(c), (e), (h) and (i) of the GDPR is implemented. The provision is not 
REQUEST FOR A PRELIMINARY RULING OF 19. 2. 2025 – CASE C-205/25 
 
10  
Anonymised version 
rendered superfluous by Article 15(4) of the GDPR, since Article 20(2) of the 
BayDSG protects not only the rights of third parties but also those of the 
BayLDA. 
The ability of the data protection supervisory authorities to function may be an 
important objective of general public interest (Article 23(1)(e) and (h) of the 
GDPR). The referring court, however, considers it doubtful whether the fulfilment 
of requests for access could limit in particular the BayLDA’s ability to function. 
While it is true that the fulfilment of requests for access ties up resources, it seems 
unlikely that this could lead to the work of the supervisory authorities becoming 
paralysed. Other German supervisory authorities are not aided by a provision in 
Land law comparable to that of Article 20(2) of the BayDSG, without this 
preventing those authorities from being able to carry out their tasks. Justifying 
Article 20(2) of the BayDSG on the grounds of public security (Article 23(1)(c) of 
the GDPR) is therefore far from compelling. The referring court also sees no 
particular tension between the independent supervisory task of the data protection 
supervisory authorities and the right of access. The schematic handling of requests 
for access in favour of persons entitled to information in no way jeopardises the 
independence of the information-providing authority’s fulfilment of its tasks. 
Independence does not require that the lawfulness of the processing of personal 
data by the supervisory authority should not be subject to verification by data 
subjects. The referring court cannot understand the risk, alleged by the BayLDA, 
of ‘influence’ which might be encouraged by access to information. 
The rights of third parties (Article 23(1)(i) of the GDPR) – as the BayLDA also 
appears to acknowledge – is already protected by Article 15(4) of the GDPR. 
Furthermore, complete exclusion from the right of access would, at best, only 
negligibly minimise the probability that personal data of third parties would be 
disclosed to a person having a right of access. 
In any case, in the opinion of the referring court, Article 20(2) of the BayDSG 
does not constitute a necessary and proportionate measure for achieving an 
objective. The objectives of Article 23(1) of the GDPR are at best marginally 
protected by the provision at issue, with the result that its weight in the review of 
proportionality to be carried out is negligible. By contrast, the right of access 
provided for in Article 15 of the GDPR has the status of a fundamental right 
(second sentence of Article 8(2) of the Charter of Fundamental Rights). The 
referring court sees no indication that the data protection supervisory authorities – 
specifically as compared with other authorities – might need special protection 
against requests for access, without which the effective and impartial performance 
of their tasks would be jeopardised. Therefore, the blanket exclusion from rights 
of access and inspection laid down in Article 20(2) of the BayDSG appears to be 
disproportionate. 
The Court of Justice of the European Union has, in the meantime, made it clear 
that, in contrast to the explanatory memorandum, the right to lodge a complaint is 
not merely similar to that of a petition (Court of Justice of the European Union, 
BAYERISCHES LANDESAMT FÜR DATENSCHUTZAUFSICHT 
 
11 
Anonymised version 
judgment of 7 December 2023 – C-26/22, C-64/22, ECLI:EU:C:2023:958 – juris 
paragraph 58 et seq.). 
Although the restriction laid down in Article 20(2) of the BayDSG affects the 
fundamental right arising from the second sentence of Article 8(2) of the Charter 
of Fundamental Rights, the referring court does not consider that the restriction of 
Article 15 of the GDPR brought about as a result disregards the essence of 
fundamental rights and freedoms. 
b) 
The referring court also doubts whether Article 20(2) of the BayDSG meets the 
formal requirements of Article 23(2) of the GDPR. 
It is true that, as is made clear, for example, by the English version of 
Article 23(2) of the GDPR (‘where relevant’), not all restrictive national 
legislative measures need comply cumulatively with the formal requirements of 
that provision. This is because not every formal requirement under Article 23(2) 
of the GDPR lends itself to a provision restricting the right of access under 
Article 15 of the GDPR. 
However, it must be stated that Article 20(2) of the BayDSG restricts, in 
substance, the right arising from Article 15 of the GDPR, without reference being 
made in the provision itself or otherwise in its systemic context to the fact that 
Article 15 of the GDPR is being restricted. It is therefore questionable whether 
Article 23(2)(c) of the GDPR, which requires a legislative measure to contain 
specific provisions, where relevant, as to the scope of the restrictions introduced, 
is satisfied. Also questionable is the extent to which in the present case – in the 
event of a blanket exclusion from the right of access to files and records of the 
supervisory authority – specific provisions, as required by Article 23(2)(g) and (h) 
of the GDPR, are lacking in the legislative measure at issue concerning the risks 
to the rights and freedoms of data subjects and the right of data subjects to be 
informed about the restriction. The Bavarian legislature has shown elsewhere in 
the BayDSG that the requirements of Article 23(2) of the GDPR are known: For 
example, Article 10 of the BayDSG, which expressly mentions Article 15 of the 
GDPR and lays down, in paragraph (3) thereof, an obligation to inform the data 
subject, in particular where access is not granted or is only granted to a limited 
extent, clearly transposes Article 23(2) of the GDPR. 
C. Stay of proceedings 
[…] 
[…] [Instruction regarding right of appeal] 
REQUEST FOR A PRELIMINARY RULING OF 19. 2. 2025 – CASE C-205/25 
 
12  
Anonymised version 
[…]  […]  […] 
 […]  […]  
 
[…] 
[Signatures]