On 18 June 2026, the Court of Justice of the European Union (the “CJEU”) confirmed that a data subject may pursue court proceedings and, in parallel, make a complaint to a supervisory authority in respect of the same alleged infringement of the GDPR.
In Case C-414/24, Datenschutzbehörde, the CJEU ruled that a supervisory authority cannot reject a complaint made under Article 77(1) GDPR on the sole ground that the data subject has already brought court proceedings under Article 79(1) GDPR concerning the same alleged infringement. This applies even where a decision has been delivered in those proceedings but has not yet become final. The CJEU confirmed that the two remedies are concurrent and independent.
While the CJEU found that parallel proceedings must be possible, it also recognised the practical difficulties that may arise, particularly the risk of inconsistent or contradictory decisions. Member States may address those risks through administrative and judicial procedural rules, including rules permitting a supervisory authority to suspend its examination of an Article 77(1) complaint pending the outcome of related judicial proceedings.
Background
The law
Article 77(1) GDPR provides that, without prejudice to any other administrative or judicial remedy, a data subject has the right to lodge a complaint with a supervisory authority where they consider that the processing of their personal data infringes the GDPR. Separately, Article 79(1) GDPR gives data subjects a right to an effective judicial remedy against a controller or processor where they consider that their GDPR rights have been infringed as a result of the processing of their personal data. That right also applies without prejudice to other available administrative or non-judicial remedies, including the right to lodge a complaint under Article 77(1).
The facts
Datenschutzbehörde concerned a dispute between a physician, as data subject, and a company operating a search platform on which third parties could post reviews and testimonials about physicians. On 3 July 2017, the data subject asked the platform operator to erase their personal data. The request was refused and, in November 2017, the data subject brought proceedings before an Austrian civil court alleging infringement of their data protection rights and seeking erasure of the published data and an order preventing its further processing.
After the GDPR became applicable in May 2018, the data subject lodged a complaint with the Austrian Data Protection Authority (the “DSB”) under Article 77(1), relying on the right to erasure under Article 17 GDPR. The DSB rejected the complaint because it concerned the same subject matter as the existing civil proceedings. It considered that allowing the regulatory complaint and court proceedings to proceed concurrently or successively would be inconsistent with the GDPR remedial framework and could result in contradictory decisions.
The data subject challenged the DSB’s decision. The dispute ultimately came before the Austrian Supreme Administrative Court, which referred two questions to the CJEU. It asked whether Articles 77 and 79 GDPR permit a supervisory authority to reject a complaint where court proceedings concerning the same subject matter are already pending and whether the position differs where a substantive judgment has been delivered but is not yet final.
The CJEU decision
The CJEU held that Articles 77(1) and 79(1) GDPR preclude a supervisory authority from rejecting a complaint solely because Article 79 proceedings concerning the same subject matter have already been brought, including where a decision in those proceedings has been delivered but is not yet final. The CJEU noted that both provisions expressly state that the relevant remedy applies “without prejudice” to other remedies available to the data subject. Neither the supervisory authority nor the national courts have priority or exclusive jurisdiction to determine whether the GDPR has been infringed. The remedies must therefore be capable of being exercised concurrently and independently.
The CJEU also highlighted the supervisory authority’s obligation under Article 57(1)(f) GDPR to handle complaints and investigate their subject matter to the extent appropriate. The existence of pending judicial proceedings, without a final decision, is not in itself sufficient to relieve a supervisory authority of that obligation. Member States retain procedural autonomy as to how parallel remedies are coordinated, provided that the applicable rules comply with the principles of equivalence and effectiveness and do not undermine the rights conferred by the GDPR or the right to an effective remedy and a fair trial under Article 47 of the Charter of Fundamental Rights of the European Union.
Accordingly, a supervisory authority cannot reject a complaint solely because parallel court proceedings concerning the same subject matter have commenced. The CJEU observed that ongoing court proceedings may be dismissed as inadmissible or withdrawn without producing a substantive determination. If the supervisory authority could reject the complaint in the meantime, a later complaint might be time-barred, depriving the data subject of effective protection.
The CJEU acknowledged that parallel proceedings may create a risk of conflicting decisions. However, Member States may adopt procedural rules to manage that risk while protecting data subjects’ rights. Those rules may permit the supervisory authority to suspend consideration of an Article 77 complaint while court proceedings concerning the same subject matter are ongoing, including, where appropriate, until an appeal has been determined.
Comment
The judgment is relevant to the Irish Data Protection Commission’s (the “Irish DPC”) approach to parallel proceedings. The Irish DPC currently states in its published FAQs that it may have to suspend or conclude an examination where continuing that examination would interfere with parallel court proceedings. Following the CJEU’s decision, the mere existence of parallel court proceedings cannot, of itself, justify rejecting an Article 77 complaint. However, the judgment recognises that Member States may adopt procedural mechanisms, consistent with the principles of equivalence and effectiveness, to manage the practical difficulties arising from concurrent proceedings, including the risk of inconsistent decisions. Suspension of one set of proceedings may therefore remain appropriate in certain circumstances.
For controllers, the decision increases the likelihood of having to manage regulatory and court proceedings concerning the same alleged GDPR infringement at the same time. This makes coordination of the factual record, legal positions, disclosure and communications across both processes particularly important, not least because evidence or positions advanced in one forum may have implications for the other.
Contact us
For more information, please contact any member of our Technology and Innovation Group or your usual Matheson contact.
