The Court of Justice of the European Union (“CJEU”) clarified in Case C-414/24 that data subjects may, in principle, pursue data protection claims concurrently before civil courts and supervisory authorities. A data protection authority may therefore not reject a complaint under Article 77 of the GDPR solely because a judicial remedy under Article 79 of the GDPR concerning the same matter is already pending and a final decision has not yet been rendered.

Background of the Decision

This decision stemmed from an Austrian legal dispute between a physician and the data protection authority. The physician had requested that the operator of a physician search and review platform delete certain personal data. After the platform operator rejected the request for deletion, the physician initially filed a civil lawsuit seeking, among other things, the deletion of the published data and an injunction against further processing.

After the GDPR came into effect, the doctor submitted another request for deletion, which was again rejected. She subsequently filed a complaint with the data protection authority under Article 77(1) of the GDPR, relying in particular on the right to erasure under Article 17 of the GDPR. The Data Protection Authority (“DPA”) rejected this complaint on the grounds that it concerned the same subject matter as the civil lawsuit already pending. Furthermore, the DPA took the view that conducting parallel or successive proceedings before a supervisory authority and a court would be contrary to the GDPR’s legal protection mechanism, such that simultaneous exercise of the right to lodge a complaint and the right to seek judicial remedy regarding the same subject matter was not permissible.

The Federal Administrative Court, by contrast, held that parallel legal remedies were in principle possible, but dismissed the complaint on the grounds of late filing. Both the physician and the DSB filed appeals against this decision with the Administrative Court (“VwGH”).

The VwGH essentially referred the question to the CJEU as to whether a data protection authority may dismiss a complaint if a judicial remedy under Article 79 of the GDPR concerning the same matter has already been filed. In addition, the VwGH sought to know whether this might be permissible in any event if a decision on the merits—which is not yet final—has already been issued in the judicial proceedings.

Decision of the CJEU

The CJEU clearly rejected such mere dismissals. According to the wording of the GDPR, the right to lodge a complaint with a supervisory authority and the right to seek judicial remedy against data controllers are expressly without prejudice to other legal remedies. It follows that neither the supervisory authority nor the court has exclusive or priority jurisdiction. Data subjects may therefore utilize multiple avenues of legal protection simultaneously and independently of one another.

A supervisory authority is therefore prohibited from rejecting a complaint solely on the grounds that a judicial remedy concerning the same matter has previously been filed, as long as the court decision has not yet become final.

Threat to Effective Legal Protection

The CJEU bases its ruling primarily on the principles of effectiveness and equivalence. In principle, Member States may determine for themselves how the interplay between the various legal remedies is structured in terms of procedural law. However, these discretionary powers are limited where the exercise of rights arising from the GDPR is rendered practically impossible or unduly burdensome, or where legal remedies under EU law are treated less favorably than comparable national legal remedies. The complaint procedure before the DPA constitutes an independent legal remedy mechanism designed to protect the interests of data subjects.

If complaints were dismissed solely because of a parallel civil action pending, a significant risk to legal protection would arise, since at the time of dismissal it cannot be assumed with certainty whether a decision on the merits will be rendered at all. For example, the proceedings could be terminated for formal reasons, or the lawsuit could be withdrawn. If, in the meantime, the deadline for filing a complaint with the data protection authority expires, the data subject would be left without any further legal recourse regarding this remedy.

No Dismissal, but Suspension Possible

To prevent the risk of conflicting decisions, national law may provide that the data protection authority suspend its proceedings if judicial proceedings on the same matter are already pending. The suspension may remain in effect until the judicial proceedings are finally resolved. This prevents the risk of conflicting decisions on the one hand, while not restricting the legal protection of data subjects on the other. Once the court decision becomes final, the authority must then duly take it into account when resuming its proceedings.

Conclusion

With this decision, the CJEU reinforces the multi-track system of legal protection under the GDPR. Data subjects do not have to choose between filing a complaint and bringing a lawsuit, as both remedies coexist and can be exercised independently of one another.
For data controllers and processors, this decision means that they must anticipate parallel proceedings in data protection disputes. A pending civil lawsuit does not automatically preclude an administrative complaint procedure. This makes a consistent presentation of the facts all the more important, as contradictory statements to courts and authorities can weaken one’s legal position.

For supervisory authorities, this means that complaints may not be dismissed solely on the grounds of parallel court proceedings. Rather, the proceedings may be suspended until the court proceedings are finally resolved; once concluded, the court’s decision must be duly taken into account in the continuation and resolution of the administrative proceedings.