Lindenberg: The Data Protection Watchdog Is Also a Controller
The CJEU holds that a regulator handling a GDPR complaint must, in principle, answer the complainant's own access request, and strikes down Bavaria's blanket bar.
On 5 November 2026 the Court of Justice of the EU decided Case C-205/25, Lindenberg, a reference from the Bavarian Administrative Court in Ansbach. A journalist had complained to the Bavarian data protection authority about a third party; when he then asked the authority, under Article 15 GDPR, for the personal data it held about him in that complaint file, it refused, relying on a Bavarian statute that excludes any right of access to the regulator's files. The authority later released the file anyway, without accepting any duty to do so, and the case continued as a test of principle. The Court answered both questions against the regulator: a supervisory authority handling an Article 77 complaint is a "controller" and must, in principle, give the complainant access to his own data; and Article 23 GDPR precludes a national rule that denies complainants that right across the board. This matters because it confirms that those who police the GDPR are themselves policed by it!
In my view the judgment is right on both counts. The authority's argument that Articles 77 and 78 exhaustively govern a complainant's rights would have placed regulators in a zone of immunity that the GDPR nowhere creates, and the Ansbach court rightly doubted that answering access requests could paralyse a regulator when other German authorities manage without such a bar. The gap lies in what comes next. The Court did not say authorities must open their files to everyone; Article 15(4) still protects the rights of others, and the Advocate General had suggested excluding internal legal analysis and drafts. Companies under investigation will now ask how much of what they disclose to a regulator can reach the complainant, and I believe authorities need clear, published redaction procedures before the first wave of requests arrives. The practical lesson for lawmakers everywhere is simple: a restriction on data subject rights must be specific, reasoned and proportionate; a one-line blanket exclusion is not!
Source: EU Law Live, 5 November 2026; Insight EU Monitoring, 5 November 2026; PPC Land, 19 October 2026. Image: Wikimedia Commons, FrDr, CC BY-SA 4.0.
