The Court of Justice of the European Union is listed to deliver its judgment in case C-205/25 on November 5, 2026, deciding whether a data protection authority that handles a complaint must also answer the complainant's own GDPR access request - and whether Bavaria can refuse all such requests by statute.

In Short

A journalist asked Bavaria's privacy regulator for a copy of the data it held about him in his own complaint file, and the regulator said a state law lets it refuse everyone. Europe's top court will decide on November 5 whether privacy watchdogs have to follow the same access rules they enforce on companies. If the court agrees with the German judges who sent the case, regulators across the EU will have to hand complainants their personal data on request.

A date for judgment

The delivery date surfaced on October 19, 2026, in a LinkedIn post by Luis Alberto Montezuma, who describes himself as working in global privacy regulatory affairs. The post reproduces the court's case listing - "C-205/25 - Bayerisches Landesamt für Datenschutzaufsicht," marked "Pending," with "Date of delivery: 05/11/2026" - and attaches the 12-page English translation of the original request for a preliminary ruling. The court writes dates day first, so the listing points to November 5, 2026. PPC Land could not load the court's own case page to confirm the entry independently.

The timing closes a procedure that began more than four years ago. PPC Land reported in April that Advocate General Rimvydas Norkus had delivered his opinion on April 16, 2026, concluding that supervisory authorities act as controllers when they process complainants' data and that Bavaria's blanket exclusion conflicts with Article 23 of the GDPR. That opinion followed a hearing on January 22, 2026. Advocate General opinions do not bind the court.

How the dispute started

The referral, made by the Bayerisches Verwaltungsgericht Ansbach (Bavarian Administrative Court, Ansbach) on February 19, 2025 and lodged in Luxembourg on March 17, 2025, sets out a short chain of events. The applicant, Joachim Lindenberg, is a journalist from Karlsruhe who runs a blog that deals, among other topics, with data protection. According to the court, he had lodged a number of complaints with the Bavarian Data Protection Authority (BayLDA) since 2021.

On May 13, 2022, he filed another complaint, and the BayLDA opened a supervisory procedure against a third party. On October 11, 2022, the authority told him by email that it had found breaches by that party and that a warning with costs would follow if further breaches occurred after a deadline for improvements. Lindenberg asked the same day for more detail on the measures taken. When that went unanswered, he filed a full access request under Article 15(1) and (3) of the GDPR, also on October 11.

The BayLDA refused on October 20, 2022. Its reasoning rested on a single sentence of Bavarian law. Article 20(2) of the Bayerisches Datenschutzgesetz (BayDSG) states: "There shall be no rights of access or inspection with respect to the files and records of the supervisory authority."

Lindenberg sued on December 6, 2022, initially seeking a copy of all data in the complaint file. Then, on February 23, 2024, the BayLDA granted electronic access to the file - "without, however, recognising any legal obligation to do so," according to the referral. The case continued anyway. Lindenberg now seeks only a declaration that the October 2022 refusal was unlawful, which turns the dispute into a test of the principle rather than a fight over documents.

The two questions

The Ansbach court asked the Court of Justice two questions. The first is whether a supervisory authority acting on a complaint under Article 77 GDPR is "at the same time a 'controller'" under Article 4(7), and therefore obliged to answer an Article 15 request. The second, which arises only if the answer is yes, is whether Article 23 GDPR precludes national legislation that "excludes, in a blanket manner, rights of access or inspection with respect to files and records of supervisory authorities."

The outcomes map cleanly onto the case. A "no" to the first question ends the matter: access would already be excluded under EU law and the Bavarian provision becomes irrelevant. A "yes" followed by a "no" means the BayLDA was entitled to rely on Article 20(2), and the action fails. Two affirmative answers mean the refusal was unlawful.

The regulator's position

According to the referral, the BayLDA argues that the rights of a complainant against a supervisory authority are "governed exhaustively by Articles 77 and 78 of the GDPR," which would leave no room for the general data subject rights. Some German commentary and a March 24, 2021 ruling of the Munich Administrative Court point the same way.

On the second question, the BayLDA put forward a longer list of justifications. Supervisory authorities, it says, depend on being able to promise confidentiality to the controllers and processors they investigate. The provision also protects complainants' own expectations of confidentiality, reflects the staff secrecy duty in Article 54(2) GDPR, and protects the authorities' complete independence, which would otherwise be strained between their supervisory role and the bodies they oversee. On that basis the authority claims the rule implements Article 23(1)(c), (e), (h) and (i) - public security, important public interests, monitoring and regulatory functions, and the rights of others.

The referring court's doubts

The Ansbach judges were not persuaded, and the referral says so plainly. On the first question, the court sees nothing in the GDPR suggesting the EU legislature wanted supervisory authorities - which "by its very nature, must process personal data in the context of the complaint procedure" - to sit outside the controller framework. The purpose of the right of access, enabling a person to check the lawfulness of processing under recital 63, works just as well against a regulator that is itself bound by data protection law.

On the second question, the court expressed "serious doubts." The Bavarian explanatory memorandum names Article 23 as the legal basis but, the court notes, does not identify any objective listed in it. Answering requests ties up resources, the court accepts, yet it found it "unlikely that this could lead to the work of the supervisory authorities becoming paralysed." Other German supervisory authorities work without any comparable state-law provision.

The independence argument fared no better. "Independence does not require that the lawfulness of the processing of personal data by the supervisory authority should not be subject to verification by data subjects," the court wrote, adding that it "cannot understand the risk, alleged by the BayLDA, of 'influence' which might be encouraged by access to information." Third-party rights, meanwhile, are already covered by Article 15(4) GDPR, which allows information to be withheld where it would harm others.

The court also flagged a formal defect. Article 20(2) restricts Article 15 without mentioning it, while Article 23(2) requires restricting measures to contain specific provisions where relevant, including on the scope of restrictions and on informing data subjects. The Bavarian legislature knew how to do this, the referral observes: Article 10 of the same statute expressly names Article 15 GDPR and requires reasons to be recorded and given when access is refused.

There is one point the court conceded to the BayLDA's side. It did not consider that the blanket exclusion destroys "the essence of fundamental rights" under Article 8(2) of the Charter. Its objection is proportionality, not essence.

Broader reach than one complaint

The scope of the Bavarian rule is wider than the facts suggest. According to the referral, Article 20(2) also covers the files of the Bavarian Data Protection Officer, the separate authority for public bodies. In the court's reading and in BayLDA practice, the rule is not limited to complaint files but extends to data collected in all of the authority's other activities. The BayDSG contains no provision allowing exceptions.

Volume matters too. The BayLDA recorded 9,746 complaints and supervisory prompts in 2025, a 61 percent increase on the year before and the highest figure since the GDPR took effect, with 43 approved positions at the end of 2025. Every one of those complainants is a potential requester if the court rules against the authority.

The referral also points to an earlier shift in the court's case law. The Bavarian legislature had treated a data protection complaint as akin to a parliamentary petition. The Ansbach court notes that the Court of Justice made clear in its judgment of December 7, 2023, in joined cases C-26/22 and C-64/22, that the complaint right is not merely similar to a petition.

What it means for marketers and ad tech

For companies on the receiving end of complaints - publishers, ad tech vendors, retailers running tracking - the case touches what happens to the information they hand regulators. The BayLDA's main defence is that access requests would undermine the confidentiality controllers expect when they cooperate with an investigation. A judgment for Lindenberg would not open investigation files wholesale; Article 15 covers the requester's personal data, and Article 15(4) still shields third parties. The Advocate General went further in drawing that line, excluding internal legal analysis and drafts. But complainants would gain a statutory route to see what a regulator holds about them in a case, and regulators would need procedures to answer within GDPR deadlines.

The case also sits alongside other recent rulings on the relationship between regulators and the people they oversee. In February, the court allowed WhatsApp Ireland to challenge binding decisions of the European Data Protection Board directly. In July, it ruled that Sweden could not use national free-expression law to shield a paid criminal-conviction database from the GDPR, another instance of a national carve-out tested against EU law. Access rights themselves have long been contested: the Austrian authority ordered YouTube in August 2025 to answer a request first filed in October 2018.

What the court cannot do on November 5 is change the facts. The BayLDA already released the file in February 2024. The question left is whether it had to.

Timeline

Summary

Who: Joachim Lindenberg, a journalist and blogger from Karlsruhe; the Bavarian Data Protection Authority (BayLDA); the Bavarian Administrative Court, Ansbach; and the Court of Justice of the European Union.

What: The Court of Justice is listed to deliver judgment in case C-205/25, deciding whether a data protection authority handling a complaint is a controller obliged to answer the complainant's Article 15 GDPR access request, and whether Bavaria's blanket statutory exclusion of access to supervisory files is compatible with Article 23 GDPR.

When: The judgment is scheduled for November 5, 2026, according to the court listing shared on LinkedIn on October 19, 2026. The reference dates from February 19, 2025, and the Advocate General's opinion from April 16, 2026.

Where: The dispute arose in Bavaria, Germany, and is before the Court of Justice in Luxembourg; the ruling will apply across the EU.

Why: The BayLDA refused Lindenberg's request in October 2022 on the basis of Article 20(2) BayDSG. The referring court doubts that the blanket ban is necessary or proportionate, and the outcome will decide whether regulators answer to the same access rights they enforce on companies.