Opinion of the Advocate General — ECLI:EU:C:2025:656
Date: 2025-09-04
Language of the case: German

Translation C-414/24 – 1 
Case C-414/24 
Request for a preliminary ruling 
Date lodged: 
13 June 2024 
Referring court: 
Verwaltungsgerichtshof (Austria) 
Date of the decision to refer: 
17 May 2024 
Appellants on a point of law: 
Datenschutzbehörde 
Dr G.S. 
Other party: Federal Minister of Justice 
Intervener: 
D GmbH 
  
The Verwaltungsgerichtshof (Supreme Administrative Court, Austria), …, in the 
appeal proceedings on a point of law brought by (1) the Datenschutzbehörde (Data 
Protection Authority, Austria) and (2) Dr G.S. … against the decision of the 
Bundesverwaltungsgericht (Federal Administrative Court, Austria) of 4 December 
2020 … regarding a matter of data protection law (respondent authority before the 
administrative court: Data Protection Authority; other party: Federal Minister of 
Justice; intervener: D GmbH ...), has made the following 
Order: 
The following questions are referred to the Court of Justice of the European Union 
(‘the Court’) for a preliminary ruling in accordance with Article 267 TFEU: 
Are Articles 77 and 79 of Regulation (EU) 2016/679 of the European Parliament 
and of the Council of 27 April 2016 on the protection of natural persons with 
regard to the processing of personal data and on the free movement of such data, 
and repealing Directive 95/46/EC (General Data Protection Regulation – ‘the 
EN 
REQUEST FOR A PRELIMINARY RULING OF 17. 5. 2024 – CASE C-414/24 
 
2  
GDPR’) to be interpreted, in the light of the findings of the Court in the judgments 
of 12 January 2023, Nemzeti Adatvédelmi és Információszabadság Hatóság, 
C-132/21, and of 7 December 2023, SCHUFA Holding (Discharge from 
remaining debts), C-26/22 and C-64/22, as meaning 
1. that the possibility provided by national law for the rejection of a complaint 
lodged with a supervisory authority under Article 77 of the GDPR on the ground 
that a judicial remedy has already been sought in the same case under Article 79 
of the GDPR and that the action is pending before a court constitutes a permissible 
arrangement for regulating the relationship between those remedies within the 
meaning of the above-mentioned case-law of the Court and, if the answer to the 
first question is in the negative, 
2. that the possibility provided by national law for the rejection of a complaint 
lodged with a supervisory authority under Article 77 of the GDPR on the ground 
that a substantive judgment (even if not yet final) has already been made in the 
pending proceedings in the same case on the judicial remedy under Article 79 of 
the GDPR constitutes a permissible arrangement for regulating the relationship 
between those remedies within the meaning of the above-mentioned case-law of 
the Court? 
Grounds: 
1. Facts and main proceedings 
1 1.1. The following facts underlying the appeals on a point of law emerge from the 
decision contested in the present case: 
2 Relying on the legal position prior to the entry into force of the GDPR, G.S., a 
physician (the second appellant), on 3 July 2017 requested the erasure of personal 
data, which she specified in detail, by D GmbH (the intervener), a company 
operating a physician search platform which enables third parties to enter 
feedback and assessments regarding physicians’ services. In a letter dated 10 July 
2017, that erasure request was refused. In November 2017, the second appellant 
brought a civil action against the intervener, claiming – among other things – an 
infringement of her right to data privacy and seeking erasure of the second 
appellant’s data published by the intervener as well as prohibition of any further 
processing. 
3 Following the entry into force of the GDPR, the second appellant again requested 
the intervener, in a letter dated 22 June 2018, to erase her data from its platform. 
In a letter dated 6 July 2018, that erasure request was likewise refused. 
4 On 26 July 2018, the second appellant lodged a complaint under Article 77 of the 
GDPR with the Data Protection Authority (Datenschutzbehörde – ‘the DSB’, the 
first appellant), relying primarily on Article 17 of the GDPR (Right to erasure). In 
that complaint, the second appellant asked the DSB to determine that her rights 
DATENSCHUTZBEHÖRDE 
 
3 
had been infringed and to require the intervener to erase all of the data from its 
platform and to refrain from any further processing. 
5 1.2. In a decision dated 4 January 2019, the DSB rejected that complaint. 
6 The DSB based its decision on the ground that both the judicial proceedings 
instituted in November 2017 and the procedure before the DSB related to the 
same subject matter, namely the erasure of the second appellant’s data from the 
intervener’s platform. In legal terms, the DSB took the view that parallel or 
successive actions before a supervisory authority and a court, when considered 
from a systemic perspective, would be inconsistent with the remedial mechanism 
of the GDPR. In the procedure at issue, the DSB considered that it would have to 
adjudicate on the same question, from a data protection perspective, as the civil 
court. There could be no question, it held, of anyone exercising both the right to 
lodge a complaint with the supervisory authority and the right to a judicial remedy 
in the same case. 
7 1.3. In the decision under appeal of 4 December 2020, the 
Bundesverwaltungsgericht (Federal Administrative Court – ‘the BVwG’) 
dismissed the second appellant’s action against the decision of the DSB. 
8 The BVwG based its decision on the findings of the DSB. In its legal reasoning, 
the BVwG began by observing that the provision for a two-track remedy in the 
GDPR was intentional. Since the GDPR was directly applicable, it stated, contrary 
national provisions must be disapplied. There could therefore be no question, 
according to the BVwG, of rejecting the second appellant’s complaint under 
Article 77 of the GDPR on the grounds cited by the DSB. On the contrary, it held, 
the decision-making power of the DSB must, in principle, be acknowledged 
9 The BVwG then referred to the statute of repose enshrined in Paragraph 24(4) of 
the Datenschutzgesetz (Austrian Law on data protection), whereby the right to 
have a complaint of data protection infringement dealt with expires if the 
intervening party does not lodge the complaint within a year after having gained 
knowledge of the incident that gave rise to the complaint. Since the second 
appellant had been aware on 3 July 2017 of the publication of her data by the 
intervener and no additional material fact had been asserted in the subsequent 
course of the proceedings, the right to have her complaint dealt with on the basis 
of Article 77 of the GDPR had already expired by the time it was lodged on 
26 July 2018. The change in the legal position, namely the entry into force of the 
GDPR, did not result in an interruption of the limitation period, the BVwG 
observed. Since a complaint under Article 77 of the GDPR was also to be rejected 
if it were lodged late, rejection of the second appellant’s complaint had ultimately 
been the correct decision. 
10 1.4. As can be seen from the case file before the Supreme Administrative Court, 
the second appellant’s civil action for erasure of the data had already been 
REQUEST FOR A PRELIMINARY RULING OF 17. 5. 2024 – CASE C-414/24 
 
4  
dismissed in substance by the judgment at first instance of 23 July 2020. At the 
time of the BVwG decision, however, that judgment was not yet final. 
11 1.5. Both the DSB and G.S. (after the BVwG had declined to deal with her 
complaint) lodged an appeal on a point of law with the Supreme Administrative 
Court against the decision of the BVwG. 
12 The intervener submitted a joint response to both appeals on a point of law. 
2. Relevant provisions of European Union law: 
13 The relevant recitals and provisions of Regulation (EU) 2016/679 of the European 
Parliament and of the Council of 27 April 2016 on the protection of natural 
persons with regard to the processing of personal data and on the free movement 
of such data, and repealing Directive 95/46/EC (General Data Protection 
Regulation) read, in extract, as follows: 
‘[Recitals] 
(11) Effective protection of personal data throughout the Union requires the 
strengthening and setting out in detail of the rights of data subjects and the 
obligations of those who process and determine the processing of personal data, as 
well as equivalent powers for monitoring and ensuring compliance with the rules 
for the protection of personal data and equivalent sanctions for infringements in 
the Member States. 
... 
(141) Every data subject should have the right to lodge a complaint with a single 
supervisory authority, in particular in the Member State of his or her habitual 
residence, and the right to an effective judicial remedy in accordance with 
Article 47 of the Charter if the data subject considers that his or her rights under 
this Regulation are infringed or where the supervisory authority does not act on a 
complaint, partially or wholly rejects or dismisses a complaint or does not act 
where such action is necessary to protect the rights of the data subject. The 
investigation following a complaint should be carried out, subject to judicial 
review, to the extent that is appropriate in the specific case. The supervisory 
authority should inform the data subject of the progress and the outcome of the 
complaint within a reasonable period. If the case requires further investigation or 
coordination with another supervisory authority, intermediate information should 
be given to the data subject. In order to facilitate the submission of complaints, 
each supervisory authority should take measures such as providing a complaint 
submission form which can also be completed electronically, without excluding 
other means of communication. 
... 
DATENSCHUTZBEHÖRDE 
 
5 
Article 17 
Right to erasure (‘right to be forgotten’) 
1. The data subject shall have the right to obtain from the controller the erasure 
of personal data concerning him or her without undue delay and the controller 
shall have the obligation to erase personal data without undue delay where one of 
the following grounds applies: 
... 
(d) the personal data have been unlawfully processed; 
… 
Article 77 
Right to lodge a complaint with a supervisory authority 
1. Without prejudice to any other administrative or judicial remedy, every data 
subject shall have the right to lodge a complaint with a supervisory authority, in 
particular in the Member State of his or her habitual residence, place of work or 
place of the alleged infringement if the data subject considers that the processing 
of personal data relating to him or her infringes this Regulation. 
... 
Article 78 
Right to an effective judicial remedy against a supervisory authority 
1. Without prejudice to any other administrative or non-judicial remedy, each 
natural or legal person shall have the right to an effective judicial remedy against a 
legally binding decision of a supervisory authority concerning them. 
... 
Article 79 
Right to an effective judicial remedy against a controller or processor 
1. Without prejudice to any available administrative or non-judicial remedy, 
including the right to lodge a complaint with a supervisory authority pursuant to 
Article 77, each data subject shall have the right to an effective judicial remedy 
where he or she considers that his or her rights under this Regulation have been 
infringed as a result of the processing of his or her personal data in non-
compliance with this Regulation. 
... 
REQUEST FOR A PRELIMINARY RULING OF 17. 5. 2024 – CASE C-414/24 
 
6  
Article 81 
Suspension of proceedings 
…2. Where proceedings concerning the same subject matter as regards 
processing of the same controller or processor are pending in a court in another 
Member State, any competent court other than the court first seized may suspend 
its proceedings. 
3. Where those proceedings are pending at first instance, any court other than 
the court first seized may also, on the application of one of the parties, decline 
jurisdiction if the court first seized has jurisdiction over the actions in question 
and its law permits the consolidation thereof. 
…’ 
3. Relevant provisions of national law 
14 Article 94 of the Bundes-Verfassungsgesetz (Federal Constitutional Law), 
Bundesgesetzblatt (Federal Law Gazette – ‘BGBl.’) No 1/1930, in the version 
promulgated in 
BGBl. I, No 114/2013, reads, in extract, as follows: 
‘Article 94. (1) Judicial and administrative powers shall be separate at all levels of 
proceedings. 
…’ 
15 Paragraph 24 of the Datenschutzgesetz (Law on data protection – DSG), BGBl I, 
No 165/1999, in the version promulgated in 
BGBl. I, No 120/2017, reads, in extract, as follows: 
‘Complaints to the Data Protection Authority 
Paragraph 24. (1) Every data subject has the right to lodge a complaint with the 
Data Protection Authority if the data subject is of the opinion that the processing 
of the personal data concerning the data subject infringes the General Data 
Protection Regulation or Paragraph 1 or Chapter 1, Article 2. 
… 
(4) The right to have a complaint dealt with expires if the intervening party does 
not lodge the complaint within a year after having gained knowledge of the 
incident that gave rise to the complaint, but no later than within three years after 
the incident allegedly occurred. Late complaints shall be rejected. 
DATENSCHUTZBEHÖRDE 
 
7 
…’ 
4. Entitlement to make the reference to the Court of Justice 
16 The Supreme Administrative Court is a court against whose decisions there is no 
judicial remedy under national law within the meaning of Article 267 TFEU. 
5. Preliminary remarks 
17 5.1. First, it should be said by way of introduction that the BVwG, explaining its 
(confirmation of the) rejection of the second appellant’s complaint under 
Article 77 of the GDPR, gave a different reason from that of the DSB, namely that 
the complaint 
was time-barred under Paragraph 24(4) of the DSG. 
18 The Supreme Administrative Court, on the other hand – partly in view of the aim 
pursued by the GDPR of strengthening the rights of data subjects (see, for 
example, judgment of the Court of 12 January 2023, C-132/21, paragraph 42) – 
takes the view that, in the present case, in which the second appellant exercised 
the right enshrined in Article 17(1) of the GDPR for the first time on 22 June 
2018, following the entry into force of the GDPR, the time limit laid down by 
Paragraph 24(4) of the DSG did not begin to run until she gained knowledge of 
the rejection of the request based on that regulation, in other words from her 
receipt of the intervener’s email of 6 July 2018 notifying her of the rejection. In 
this context, it is not relevant when the second appellant gained knowledge of the 
underlying data processing. 
19 Since, in the view of the Supreme Administrative Court, the reasons given by the 
BVwG therefore cannot justify the (confirmation of the) rejection of the second 
appellant’s complaint under Article 77 of the GDPR, the Supreme Administrative 
Court, when deciding the appeals on a point of law before it, must examine 
whether the rejection of that complaint lodged by the second appellant was 
ultimately lawful for other reasons – particularly, for example, the reason invoked 
by the DSB that the case was pending before a court. As part of that examination, 
in the view of the Supreme Administrative Court, there arise the questions 
regarding the interpretation of EU law which are formulated in this request for a 
preliminary ruling and which are further explained below. 
20 5.2. Secondly, it should be noted from the outset that the Supreme Administrative 
Court has no reason to doubt the assessment on which the BVwG based its 
decision, namely that both the judicial proceedings and the procedure before the 
DSB contain the same subject matter as regards the erasure of the data; the fact 
that other claims were made in the judicial proceedings over and above the 
asserted breach of data protection does not prejudice this assumption. The second 
appellant’s argument that, in terms of general considerations, the subject matter of 
REQUEST FOR A PRELIMINARY RULING OF 17. 5. 2024 – CASE C-414/24 
 
8  
the procedures is not identical does not alter that assessment, because it does not 
constitute a substantiated refutation of the rulings on which the present case must 
be based. 
6. General explanation of the questions referred 
21 6.1. In its judgment of 12 January 2023, Nemzeti Adatvédelmi és 
Információszabadság Hatóság, C-132/21, the Court noted the following regarding 
the interpretation of Articles 77 to 79 of the GDPR: 
‘29 Thus, by its questions, the referring court, which is seised of an action, on 
the basis of Article 78(1) of Regulation 2016/679, against the supervisory 
authority’s decision given on the basis of Article 77(1) thereof, seeks to ascertain 
whether, under the provisions of that regulation, the final judgment delivered by a 
court seised on the basis of Article 79(1) thereof is binding as regards the finding 
that there has – or has not – been an infringement of the rights guaranteed by that 
same regulation. 
… 
34 Thus, those provisions of Regulation 2016/679 offer different remedies to 
persons claiming that that regulation has been infringed, it being understood that 
each of those remedies must be capable of being exercised ‘without prejudice’ to 
the others. 
35 It follows, first of all, from the wording of those provisions that Regulation 
2016/679 does not provide for any priority or exclusive competence or jurisdiction 
or for any rule of precedence in respect of the assessment carried out by the 
authority or by the courts referred to therein as to whether there is an infringement 
of the rights conferred by that regulation. The remedy provided for in 
Article 78(1) of that regulation, the purpose of which is to examine the lawfulness 
of the decision of a supervisory authority adopted on the basis of Article 77 
thereof, and the remedy provided for in Article 79(1) of that regulation may 
therefore be exercised concurrently with and independently of each other. 
36 Next, that finding is borne out by the context of the provisions of Regulation 
2016/679 at issue. 
37 Although the EU legislature has expressly regulated the relationship 
between the remedies provided for by Regulation 2016/679 in the event of the 
supervisory authorities or courts of several Member States being seised 
simultaneously in respect of an instance of processing of personal data carried out 
by the same controller, it must be observed that this is not the case as regards the 
remedies provided for in Articles 77 to 79 of that regulation. 
38 Articles 60 to 63 of Regulation 2016/679 provide for cooperation, mutual 
assistance and coordination mechanisms under which the supervisory authorities 
DATENSCHUTZBEHÖRDE 
 
9 
are to provide each other with mutual assistance, inform each other and conduct 
joint operations with a view to ensuring a consistent and effective application of 
the provisions of that regulation throughout the European Union. 
39 In addition, Article 81(2) and (3) of that regulation lays down rules 
concerning cases where several courts of different Member States have been 
seised. 
40 By contrast, Regulation 2016/679 does not lay down such rules in respect of 
cases where a complaint has been made to a supervisory authority and judicial 
proceedings have been brought within the same Member State concerning the 
same instance of processing of personal data. 
… 
42 Lastly, regarding the objectives pursued by that regulation, it is apparent, in 
particular, from recital 10 thereof that the aim of that regulation is to ensure a high 
level of protection of natural persons with regard to the processing of personal 
data within the European Union. Recital 11 of that regulation states, moreover, 
that effective protection of such data requires the strengthening of the rights of 
data subjects. As the Advocate General observed in point 55 of his Opinion, the 
EU legislature’s decision to leave to data subjects the option to exercise the 
remedies provided for in Article 77(1) and Article 78(1) of Regulation 2016/679, 
on the one hand, and Article 79(1) thereof, on the other, concurrently with and 
independently of each other is consistent with the objective of that regulation. 
43 Regulation 2016/679 requires, inter alia, the competent authorities of the 
Member States to ensure a high level of protection of the rights guaranteed in 
Article 16 TFEU and Article 8 of the Charter. … 
44 Making several remedies available also strengthens the objective set out in 
recital 141 of Regulation 2016/679 of guaranteeing for every data subject who 
considers that his or her rights under that regulation are infringed the right to an 
effective judicial remedy in accordance with Article 47 of the Charter. 
45 In the absence of EU rules governing the matter, it is for each Member State, 
in accordance with the principle of the procedural autonomy of the Member 
States, to lay down the detailed rules of administrative and judicial procedures 
intended to ensure a high level of protection of rights which individuals derive 
from EU law. 
46 Accordingly, it is for the referring court to determine, on the basis of the 
national procedural provisions, how the remedies provided for by Regulation 
2016/679 must be implemented in a situation such as that at issue in the main 
proceedings. 
REQUEST FOR A PRELIMINARY RULING OF 17. 5. 2024 – CASE C-414/24 
 
10  
47 That said, the detailed rules for the implementation of those concurrent and 
independent remedies should not call into question the effectiveness and effective 
protection of the rights guaranteed by that regulation. 
… 
51 Thus, the Member States must ensure that the practical arrangements for the 
exercise of the remedies provided for in Article 77(1), Article 78(1) and 
Article 79(1) of Regulation 2016/679 do not disproportionately affect the right to 
an effective remedy before a court or tribunal referred to in Article 47 of the 
Charter (see, to that effect, judgment of 27 September 2017, Puškár, C-73/16, 
EU:C:2017:725, paragraph 76). 
… 
53 Therefore, it cannot be ruled out that the decisions given by those two courts 
might be contradictory, with one finding that the provisions of Regulation 
2016/679 have been infringed and the other that there has been no such 
infringement. 
54 In that case, first, the existence of two contradictory decisions would call 
into question the objective, set out in recital 10 of that regulation, of ensuring a 
consistent and homogeneous application of the rules for the protection of the 
fundamental rights and freedoms of natural persons with regard to the processing 
of personal data throughout the European Union. 
… 
56 Second, the result of this would be a weakening of the protection of natural 
persons with regard to the processing of their personal data, since such an 
inconsistency would create a situation of legal uncertainty. 
57 Having regard to all of the foregoing, the answer to the questions referred is 
that Article 77(1), Article 78(1) and Article 79(1) of Regulation 2016/679, read in 
the light of Article 47 of the Charter, must be interpreted as permitting the 
remedies provided for in Article 77(1) and Article 78(1) of that regulation, on the 
one hand, and Article 79(1) thereof, on the other, to be exercised concurrently 
with and independently of each other. It is for the Member States, in accordance 
with the principle of procedural autonomy, to lay down detailed rules as regards 
the relationship between those remedies in order to ensure the effective protection 
of the rights guaranteed by that regulation and the consistent and homogeneous 
application of its provisions, as well as the right to an effective remedy before a 
court or tribunal as referred to in Article 47 of the Charter.’ 
22 In another judgment, given on 7 December 2023 in SCHUFA Holding (Discharge 
from remaining debts), C-26/22 and C-64/22, the Court noted the following with 
reference to its judgment in Case C-132/21: 
DATENSCHUTZBEHÖRDE 
 
11 
 ‘66 In the second place, as regards the right to an effective judicial remedy 
against a controller or processor provided for in Article 79(1) of the GDPR, it 
should be noted that, according to the case-law of the Court, the remedies 
provided for, respectively, in Article 78(1) and Article 79(1) of that regulation 
may be exercised concurrently with and independently of each other … In that 
context, the Court has held, inter alia, that making several remedies available 
strengthens the objective set out in recital 141 of that regulation of guaranteeing 
for every data subject who considers that his or her rights under that regulation are 
infringed the right to an effective judicial remedy in accordance with Article 47 of 
the Charter …. 
67 Therefore, and even though it is for the Member States, in accordance with 
the principle of procedural autonomy, to lay down the detailed rules for the 
coordination of those remedies …, the existence of the right to an effective 
judicial remedy against a controller or processor, provided for in Article 79(1) of 
the GDPR, does not affect the scope of the judicial review exercised, in the 
context of an action brought under Article 78(1) of that regulation, over a decision 
on a complaint adopted by a supervisory authority.’ 
23 6.2. In constitutional terms, under Article 94 of the Federal Constitutional Law, 
judicial and administrative powers are separate at all levels of proceedings in 
Austria. From the principle of the separation of judicial and administrative powers 
enshrined in Article 94 of the Federal Constitutional Law derives the requirement 
to refer a matter in its entirety for adjudication by either the courts or the 
administrative authorities (see, for example, Verfassungsgerichtshof 
(Constitutional Court – ‘VfGH’), 12 March 2019, G 190/2018, paragraph 111). 
24 According to the jurisprudence of the Austrian Constitutional Court, the 
legislature has no domestic leeway for implementation, given the remedies 
available in EU law for breaches of data protection in the form of a complaint to 
the supervisory authority on the one hand and an effective judicial remedy on the 
other (see VfGH, 13 December 2023, G 2012/2023, et alia). 
25 It is therefore common ground that the Austrian constitutional provision in 
Article 94 of the Federal Constitutional Law, read in the light of the provisions of 
EU law – in the present case Articles 77 to 79 of the GDPR – is not inconsistent 
with the establishment of the DSB as the competent supervisory authority 
alongside the jurisdiction of the ordinary courts. Accordingly, a data subject is 
free either to lodge a complaint through administrative channels with the DSB, 
which was established in accordance with Article 77 of the GDPR, or to bring an 
action before the civil courts, both legal channels comprising mutually 
independent stages of appeal. 
26 6.3. The significance of Article 94 of the Federal Constitutional Law, however, 
cannot be reduced to a ban on the establishment of parallel jurisdictions. 
REQUEST FOR A PRELIMINARY RULING OF 17. 5. 2024 – CASE C-414/24 
 
12  
27 6.3.1. The Constitutional Court found, for instance, that courts and administrative 
authorities could not both decide on one and the same matter, whether in 
collaboration or successively as lower and higher instances (see, for example, 
VfGH, 16 December 2010, G 259/09 et alia, point III.A.2.5). A substantive review 
or amendment of court decisions by an administrative authority, being 
incompatible with the principle of the separation of judicial and administrative 
powers, remains prohibited (see VfGH, 4 October 2006, B 742/06, point III.1.5). 
A legal provision stipulating that an ordinary court, after conducting its 
examination, may, if necessary, annul or amend a decision of the administrative 
authority is not consistent with the principle of the separation of judicial and 
administrative powers enshrined in Article 94 of the Federal Constitutional Law 
and with the consequential independence of the authorities in both branches (see 
VfGH, 14 June 1985, G 17/85). A rule whereby one and the same legal question 
was to be decided either by a court or by an administrative authority, depending 
on the incidental circumstances of the individual case, would likewise be contrary 
to Article 94 of the Federal Constitutional Law (see VfGH, 15 March 1973, G 
46/72). Article 94 of the Federal Constitutional Law, in short, does not allow 
courts and administrative authorities to decide on the same case concurrently or 
consecutively (see VfGH, 14 October 1970, G 20/70) In legal writings, moreover, 
it is noted that the separation principle is designed to guarantee the independence 
of both powers from one another … [source reference in legal literature].  
28 In addition, in connection with the imposition of an administrative penalty for the 
use of offensive language (in a written submission) which, for want of 
differentiation in the wording, related to more than one matter and therefore fell 
within the jurisdiction of more than one authority, the Supreme Administrative 
Court found that, in such a case, jurisdiction rested with the authority which 
undertook the first act of prosecution, especially since the purpose of the measure 
was achieved by the single imposition of an administrative penalty (see Supreme 
Administrative Court (‘VwGH’), 25 March 1987, 86/11/0145, 0150 (enlarged 
chamber) as well as VwGH, 16 October 2014, Ra 2014/06/0004). 
29 In the light of this jurisprudence, it may at least be assumed that, in a constellation 
in which a court judgment – even if not yet final – has already been delivered in 
proceedings such as those brought under Article 79 of the GDPR in the present 
case, another decision in that case taken by a supervisory authority (or by a court 
having obtained jurisdiction by virtue of Article 78 of the GDPR) would be 
inadmissible. The complaint based on Article 77 of the GDPR would thus have to 
be rejected under the national provisions, in accordance with the principle of the 
first act of prosecution, because a substantive decision in the matter at issue had 
been delivered. The conformity of such an approach with EU law is the subject of 
the second question referred for a preliminary ruling. 
30 6.3.2. Furthermore, in connection with Article 94 of the Federal Constitutional 
Law, the Constitutional Court found that it would be unconstitutional if the legal 
provision were framed in such a way that one and the same case could be dealt 
with by enforcement bodies of different types – hence by both a court and an 
DATENSCHUTZBEHÖRDE 
 
13 
administrative authority (see VfGH, 12 March 2019, G 190/2018, paragraph 112). 
The law must not provide for the possibility of one and the same case being dealt 
with, concurrently or consecutively, by enforcement bodies of different types, in 
other words both a court and an administrative authority, without the law itself 
laying down objectively determinable conditions in which jurisdiction lies with 
one or the other enforcement body (see VfGH, 6 December 2003, G 147/01, point 
II.2.2.2). 
31 In the light of that domestic legal position, it follows that, in Austrian law, even 
the fact that a case is pending – and hence being dealt with – by a court having 
jurisdiction by virtue of Article 79 of the GDPR makes it inadmissible for the 
supervisory authority to deal with that case on the basis of a subsequent complaint 
lodged under Article 77 of the GDPR. In that event, the complaint based on 
Article 77 of the GDPR – again under the national provisions – would therefore 
have to be rejected on the ground that the case was already pending before a court. 
The conformity of such an approach with EU law is the subject of the first 
question referred for a preliminary ruling. 
7. Explanation of the first question referred 
32 According to the reasoning of the Court, set out above, in its judgment C-132/21, 
Articles 77 to 79 of the GDPR must be interpreted as ‘permitting’ the remedies 
provided for in Article 77(1) and Article 78(1) of that regulation, on the one hand, 
and Article 79(1) thereof, on the other, to be exercised concurrently with and 
independently of each other. It is for the Member States, in accordance with the 
principle of procedural autonomy, to lay down detailed rules as regards the 
relationship between those remedies in order to ensure the effective protection of 
the rights guaranteed by that regulation and the consistent and homogeneous 
application of its provisions, as well as the right to an effective remedy before a 
court or tribunal as referred to in Article 47 of the Charter (paragraph 35 and 
operative part) 
33 The Supreme Administrative Court wonders whether it is an admissible national 
arrangement within the meaning of that case-law if a complaint lodged under 
Article 77 of the GDPR is rejected without examination of the merits because the 
right to an effective judicial remedy under Article 79 of the GDPR has previously 
been exercised and the associated judicial proceedings are still pending. 
34 It should be noted in particular that the Court, in its judgment of 12 January 2023, 
C-132/21, paragraph 54 et seq., reproduced in extract above, explains that ‘the 
existence of two contradictory decisions would call into question the objective, set 
out in recital 10 of that regulation, of ensuring a consistent and homogeneous 
application of the rules for the protection of the fundamental rights and freedoms 
of natural persons with regard to the processing of personal data throughout the 
European Union’ and that ‘the result of this would be a weakening of the 
protection of natural persons with regard to the processing of their personal data, 
REQUEST FOR A PRELIMINARY RULING OF 17. 5. 2024 – CASE C-414/24 
 
14  
since such an inconsistency would create a situation of legal uncertainty’. If the 
existence of contradictory decisions is to be prevented, there is a possibility, 
within the national legal framework, of preventing contradictory decisions being 
made by independently acting bodies of the civil judiciary and the administrative 
authorities, including the administrative courts, by means of a mechanism which 
is similar in its effect to that for which Article 81(2) and (3) of the GDPR 
provides, whereby when one and the same matter is pending before the civil 
courts and the administrative authority, the body other than the one first seized 
declines jurisdiction. 
35 The main argument in favour of such an approach is that the Court, in 
paragraph 37 et seq. of the cited judgment C-132/21, explains why the remedies 
may be sought concurrently with and independently of each other by referring, 
among other things, to the absence of the kind of provisions contained in 
Articles 60 to 63 and 81 of the GDPR on cooperation between two or more 
supervisory authorities or two or more courts from different Member States. As 
the Court indicates, Articles 60 to 63 of the GDPR serve the purpose of ensuring a 
consistent and effective application of the GDPR by providing for mutual 
assistance and information obligations. For the eventuality that proceedings 
concerning the same subject matter are pending before courts in more than one 
Member State – in particular specified circumstances – Article 81(2) and (3) of 
the GDPR provides for the possibility that any competent court other than the one 
first seized may suspend its proceedings and that any court other than the one first 
seized may decline jurisdiction. These rules may imply that the national 
arrangements for which provision is to be made in a Member State for the 
eventuality of collaboration between a supervisory authority and a court may 
likewise be activated at an early stage, namely when the case becomes pending 
before both bodies, that is to say the supervisory authority and the court. Even 
though the applicable national arrangement in this case is not an exact match with 
the mechanisms set out in the GDPR for dealings between States, in view of their 
aim of ensuring consistent application of the GDPR it seems reasonable to regard 
it as permissible. 
36 It should also be pointed out that, even though the principle of an effective judicial 
remedy on which the Court relies in its reasoning focuses primarily on the 
situation of the data subject who exercises the right of judicial remedy, the data 
controller cast in the role of respondent must also be granted the right to effective 
administration of proceedings, a right which may be prejudiced by the existence 
of two parallel procedures (before the supervisory authority and before a court) 
regarding the same subject matter. The cost of legal representation in two parallel 
sets of proceedings, for example, may constitute quite a considerable burden. 
37 In the event of a complaint lodged under Article 77 of the GDPR being rejected 
on the sole ground that a judicial action is pending, however, a substantive 
decision on the asserted breach of data privacy will not yet have been made at the 
time of rejection, and so there is no risk of contradictory decisions at that stage 
either. The Court, moreover, in the cited judgment C-26/22, held, among other 
DATENSCHUTZBEHÖRDE 
 
15 
things, that the existence of the right to an effective judicial remedy provided for 
in Article 79(1) of the GDPR does not affect the scope of the judicial review 
exercised, in the context of an action brought under Article 78(1) of that 
regulation, over a decision on a complaint adopted by a supervisory authority 
(paragraph 67). 
38 For the Supreme Administrative Court, the interpretation of the provisions 
referred to above is at least not so obvious as to leave no scope for any reasonable 
doubt. 
8. Explanation of the second question referred 
39 Should the Court answer the first question in the negative, the question that would 
then arise for the Supreme Administrative Court is whether it is an admissible 
national arrangement within the meaning of the cited case-law if a complaint 
lodged under Article 77 of the GDPR is rejected because a substantive judicial 
decision – even if not yet final – has already been delivered in pending 
proceedings in the same case on the effective judicial remedy under Article 79 of 
the GDPR. 
40 Before this question is addressed, it should first be stated that the basis for a 
review of the decision of an administrative court by the Supreme Administrative 
Court is always the factual and legal situation prevailing on the date of delivery of 
the contested decision, not the date of the Supreme Administrative Court’s 
decision (see, for example, VwGH, 1 September 2022, Ra 2021/09/0130, 
paragraph 27). The BVwG, by contrast, must consider the factual and legal 
situation prevailing at the time of its own decision, even when assessing the 
admissibility of a rejection (see, for example, VwGH, 28 January 2016, Ra 
2015/07/0070). Accordingly, it is irrelevant to the BVwG, in the first place, that 
no judicial ruling had been given in the present case at the time when the DSB 
issued its decision. By the date of the BVwG ruling, however, a substantive 
judicial decision had been delivered in the proceedings instituted under Article 79 
of the GDPR. That fact was relevant to the BVwG, and hence also to the Supreme 
Administrative Court’s assessment of the appeals on a point of law in the present 
case. 
41 In the view of the Supreme Administrative Court, another argument for the 
admissibility of the arrangement described in paragraph 38 is that the Court, as 
explained above, has held the existence of contradictory decisions in a single case 
to be incompatible with the GDPR. The rejection of a complaint lodged with the 
supervisory authority on or after the date on which a decision on the substance has 
been delivered in the judicial proceedings instituted under Article 79 of the GDPR 
certainly takes account of that aim of avoiding contradictory decisions. 
42 A possible argument against the admissibility of such an arrangement in EU law is 
that reliance on a decision which is not yet final does not provide the data subject 
with any certainty regarding the continuing validity of that decision. It should also 
REQUEST FOR A PRELIMINARY RULING OF 17. 5. 2024 – CASE C-414/24 
 
16  
be pointed out that, in the constellation underlying the cited judgment C-132/21, 
there was a final judgment given by a court seized under Article 79 of the GDPR 
(by which, however, the referring court in that case, seized of the matter under 
Article 78 of the GDPR, was not bound), but significance was not explicitly 
attached to that fact in the reply to the question referred for a preliminary ruling in 
that case. 
43 Consequently, the answer to that question, too, is not entirely clear to the Supreme 
Administrative Court. 
9. Conclusion 
44 Since the application of EU law and its interpretation do not appear to be so 
obvious as to leave no scope for any reasonable doubt (see judgments of the Court 
of 6 October 1982, CILFIT and Others, C-283/81, and 6 October 2021, Consorzio 
Italian Management, C-561/19, paragraph 39 et seq.), the questions set out in the 
introductory section of this request are referred for a preliminary ruling pursuant 
to Article 267 TFEU. 
Vienna, 17 May 2024