The CJEU holds that a regulator handling a GDPR complaint must, in principle, answer the complainant's own access request, and strikes down Bavaria's blanket bar.

Read more →