DPAs are controllers for complainants, blanket file secrecy unlawful

A data protection authority handling a complaint is a controller for the complainant's dataEuropa and must grant Article 15 access to itEuropa, the Court of Justice (Third Chamber) held on 5 November 2026 in Case C-205/25 (Lindenberg v Bayerisches Landesamt für Datenschutzaufsicht). A blanket statutory ban on any access to the authority's files, like Paragraph 20(2) of the Bavarian Data Protection Act, fails Article 23 of the GDPREuropa: third-party confidentiality and the authority's functioning require balancing, redaction or targeted limits, never total refusal, and public security needs a genuine, sufficiently serious threat.

The complainant, a journalist running a data-protection blog, had lodged several complaints with the Bavarian authority since 2021. After his complaint of 13 May 2022 against a third party, the authority emailed on 11 October 2022 that it had found data-protection breaches and would issue a penalty notice on further breaches. The same day he requested full details under Article 15(1) and (3); on 20 October 2022 the authority refused, citing the Bavarian blanket ban. He sued that December for a copy of everything in the complaint file; in February 2024 the authority granted electronic file access without admitting any duty, while he still seeks a declaration that the refusal was unlawful.

On the first question the Court classifies the complaint-handling authority as a controller under Article 4(7)Europa: it records, consults, stores and uses the complainant's data, and the purposes and means of that processing arise from the EU provisions governing the authority, which may designate the controller not only explicitly but also implicitly, without the authority itself deciding them. Otherwise the complainant would lose every Chapter III right against the authority, from information and access to rectification, erasure and restriction, and the authority would escape the Article 5 principles and the Chapter IV security rules. A body can be supervisory authority and controller at once, adjusting its internal organisation so controller acts face independent supervision. But Article 15 gives access to the complainant's own personal data and the listed information, not a general right to the administrative file or every document heldEuropa.

On the second question, Article 23(1)(c), (h) and (i) preclude the blanket banEuropa. Protecting third parties' data under point (i) requires striking a balance, wherever possible through redaction or anonymisation, since the result must never be a refusal of all information. Preserving the authority's proper functioning and independence under point (h) is legitimate in principle, but exercising access cannot undermine independence, and a general abstract ban is disproportionate: administrative burden is answered by the resource duty and by Article 12(5) fees or refusals for manifestly unfounded or excessive requests. Public security under point (c) demands a genuine and sufficiently serious threat to a fundamental interest of society, of which nothing is apparent here.

Legal basis: Article 4(7) read with Article 15, and Article 23(1)(c), (h) and (i), of Regulation (EU) 2016/679.