Opinion of Advocate General Richard de la Tour delivered on 4 September 2025.

• Jurisdiction: European Union
• Celex Number: 62024CC0414
• ECLI: ECLI:EU:C:2025:656
• Date: 04 September 2025
• Court: Court of Justice (European Union)

Provisional text

OPINION OF ADVOCATE GENERAL

RICHARD DE LA TOUR

delivered on 4 September 2025 (1)

Case C‑414/24

Datenschutzbehörde,

Dr. G S

Other party:

Bundesministerin für Justiz,

D GmbH

(Request for a preliminary ruling from the Verwaltungsgerichtshof (Supreme Administrative Court, Austria))

( Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Articles 77 and 79 – Remedies – Parallel exercise – Relationship between an administrative complaint and a judicial remedy – Procedural autonomy of the Member States – Principle of effectiveness )

I. Introduction

1. The present request for a preliminary ruling concerns the interpretation of Article 77(1) and Article 79(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). (2)

2. This request was made in the context of a dispute between Dr GS (‘GS’) and the Österreichische Datenschutzbehörde (Data Protection Authority, Austria) (‘the DSB’) concerning the rejection of the complaint lodged with the DSB by GS, on the ground that GS had previously brought the same matter before a court.

3. The request for a preliminary ruling follows the judgment of 12 January 2023, Nemzeti Adatvédelmi és Információszabadság Hatóság [(3)], by which the Court of Justice held that the remedies provided for in Article 77(1) and Article 78(1) of the GDPR, on the one hand, and Article 79(1) thereof, on the other, may be exercised concurrently with and independently of each other. Article 77(1) and Article 78(1) of that regulation concern, respectively, the right to lodge a complaint with a supervisory authority (4) and the right to a judicial remedy against the decision of that authority. Article 79(1) concerns the right to judicial remedy against a controller or processor.

4. The Verwaltungsgerichtshof (Supreme Administrative Court, Austria), which is the referring court, wishes to obtain clarification from the Court as to the relationship between those remedies and, more specifically, as to whether the supervisory authority may reject a complaint where judicial proceedings concerning the same subject matter have already been brought, even though those proceedings are still pending or the decision given in those proceedings is not yet final.

5. That question is of great importance, having regard to the EU legislature’s intention, on the one hand, to impose a special duty of diligence on the supervisory authority and, on the other, to strengthen the right to effective judicial protection enshrined in Article 47 of the Charter of Fundamental Rights of the European Union. (5)

6. In this Opinion, I shall propose that the Court rule that Article 77(1) and Article 79(1) of the GDPR must be interpreted as meaning that they preclude a supervisory authority, with which a complaint has been lodged in accordance with Article 77(1) of that regulation, from rejecting that complaint on the ground that judicial proceedings under Article 79(1) of that regulation, concerning the same subject matter, have already been brought and where the decision given in those proceedings is not yet final.

7. I shall begin my analysis by recalling that the remedies provided for, in Article 77(1) and Article 78(1) of the GDPR, on the one hand, and Article 79(1) thereof, on the other, can be exercised concurrently with and independently of each other. I shall also note the Member States’ obligation to coordinate those remedies in order to avoid contradictory decisions. I shall show that that obligation to coordinate those remedies cannot affect the possibility to exercise the remedies available under the GDPR concurrently with and independently of each other by allowing the supervisory authority to reject the complaint it has received rather than suspend its investigation of that complaint until the judicial proceedings brought under Article 79(1) of the GDPR have been definitively closed.

II. Legal framework

A. European Union law

8. Article 17 of the GDPR, entitled ‘Right to erasure (“right to be forgotten”)’ provides, in paragraph 1(d):

‘The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

…

(d) the personal data have been unlawfully processed.’

9. Within Chapter VI of the GDPR, entitled ‘Independent supervisory authorities’, Section 1, on ‘independent status’, comprises Articles 51 to 54. Under Article 51(1) of the GDPR:

‘Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union …’

10. Article 52(1) of the GDPR is worded as follows:

‘Each supervisory authority shall act with complete independence in performing its tasks and exercising its powers in accordance with this Regulation.’

11. Within Chapter VI, Section 2, of the GDPR, which is entitled ‘Competence, tasks and powers’ and comprises Articles 55 to 59, Article 57(1)(a) and (f) provides:

‘Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:

(a) monitor and enforce the application of this Regulation;

…

(f) handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary.’

12. Article 58(4) of the GDPR provides:

‘The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter.’

13. Under Article 77 of the GDPR, entitled ‘Right to lodge a complaint with a supervisory authority’:

‘1. Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.

2. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.’

14. Article 78 of the GDPR, entitled ‘Right to an effective judicial remedy against a supervisory authority’ provides in paragraph 1 thereof:

‘Without prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.’

15. Article 79 of the GDPR, entitled ‘Right to an effective judicial remedy against a controller or processor’, provides in paragraph 1 thereof:

‘Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation.’

16. Article 81 of the GDPR, entitled ‘Suspension of proceedings’ states, in paragraphs 2 and 3 thereof:

‘2. Where proceedings concerning the same subject matter as regards processing of the same controller or processor are pending in a court in another Member State, any competent court other than the court first seized may suspend its proceedings.

3. Where those proceedings are pending at first instance, any court other than the court first seized may also, on the application of one of the parties, decline jurisdiction if the court first seized has jurisdiction over the actions in question and its law permits the consolidation thereof.’

B. Austrian law

17. Paragraph 94(1) of the Bundes-Verfassungsgesetz (Federal Constitutional Law), is worded as follows:

‘The courts are independent of the executive at all levels.’

18. Paragraph 24 of the Bundesgesetz zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten (Federal law on the protection of natural persons with regard to the processing of personal data) (6) of 17 August 1999, in the version applicable to the dispute in the main proceedings, entitled ‘Complaints addressed to the data protection authority’, states, in paragraphs 1 and 4:

‘(1) Every data subject has the right to lodge a complaint with the data protection authority if the data subject considers that the processing of the personal data concerning him or her infringes the GDPR …

…

(4) The right to have a complaint dealt with expires if the complainant does not lodge the complaint within a year after having gained knowledge of the incident that gave rise to the complaint, and in any event within at most three years after the incident allegedly occurred. Late complaints shall be rejected.’

III. The facts of the dispute in the main proceedings and the questions referred for a preliminary ruling

19. On 3 July 2017, before the entry into force of the GDPR, (7) GS...