Court of Justice 16 April 2026, C-205/25 (Opinion of Advocate General Norkus delivered on 16 April 2026.)

Also known as

In Case C-205/25, Advocate General Norkus opines that a data protection supervisory authority acting in the context of a complaint procedure under Article 77 GDPR simultaneously qualifies as a 'controller' within the meaning of Article 4(7) GDPR, because it independently determines the purposes and means of processing personal data collected during such proceedings, and is therefore bound by the right of access obligations under Article 15 GDPR. The Advocate General further opines that Article 23 GDPR precludes national legislation such as Article 20(2) of the Bavarian Law on Data Protection (Bayerisches Datenschutzgesetz), which categorically excludes any right of access or inspection with respect to supervisory authorities' files and records, on the grounds that such a blanket exclusion fails to identify a specific legitimate objective from Article 23(1) GDPR, deprives the right of access of its essence, and does not satisfy the requirements of necessity, proportionality, and legal precision mandated by that provision. The Opinion emphasises that Article 15 GDPR does not confer a general right of access to administrative files but is limited to personal data undergoing processing, and that less restrictive measures—such as partial disclosure, redaction, or temporary withholding—are available to reconcile the interests of supervisory effectiveness and data subject transparency.AI