The Court of Justice of the European Union has issued a preliminary ruling on the interpretation of the GDPR regarding a complainant's right of access to personal data contained in the complaint file processed by a supervisory authority.

The initial dispute involves an individual and the Bavarian Data Protection Supervisory Authority (hereinafter the "Authority") following the latter's refusal to grant access to the individual's complaint file, a request based on Article 15 of the GDPR. Seized of the case, the Bavarian Administrative Court of Ansbach submitted a request for a preliminary ruling to the Court. The referring court seeks to determine whether a supervisory authority should be considered a "controller" within the meaning of Article 4, point 7, for the personal data contained in a complaint file. It also questions the Court on the scope of the right of access in this context and on the possibility for national legislation to limit this right under Article 23 of the GDPR, in connection with the right to lodge a complaint provided for in Article 77.

The Third Chamber held that:
1) Article 4, point 7, of the GDPR must be interpreted as meaning that: in the context of proceedings concerning a complaint lodged by a data subject pursuant to Article 77 of that Regulation, a supervisory authority within the meaning of Article 4, point 21, of that Regulation must be regarded as a "controller" and, accordingly, is in principle required to grant that person access to the personal data concerning them and to the information listed in Article 15.

2) Article 23(1)(c), (h), and (i) of Regulation 2016/679 must be interpreted as precluding a national provision under which the complainant has no right of access to the personal data concerning them, as provided for in Article 15 of that Regulation, and which are held by a supervisory authority within the meaning of Article 4, point 21, of that Regulation.