Court of Justice 18 June 2026, C-185/25 (Opinion of Advocate General Norkus delivered on 18 June 2026.)

Also known as

In this Opinion (Case C-185/25, Waldfelber), Advocate General Norkus opines that a natural person who processes personal data not in his own personal interest but in the exercise of his duties as head of a public organisation, using tools prescribed to him by that organisation, does not qualify as a 'controller' within the meaning of Article 4(7) GDPR, with the organisation itself bearing that status. On the right of access under Article 15(1)(g) GDPR, the AG takes the view that where a processed opinion is attributable to the author of an email, 'any available information as to the source' does not extend to the identity of third parties with whom the author orally discussed the data subject prior to forming that opinion. The AG further opines that Article 82 GDPR does not preclude national rules (such as Paragraph 1 of the Austrian Law on public liability (Amtshaftungsgesetz)) that shift liability for damage caused by executive officers of public legal entities onto those entities, provided that an identifiable entity remains against which the data subject may bring a compensation claim.AI