knowledge 1 September 2026 |

Parallel remedies under the GDPR – CJEU clarifies role of supervisory authorities where court proceedings pending

Introduction

Article 77 of the GDPR provides data subjects, who have suffered an alleged infringement of the rights provided by the GDPR, with an entitlement to lodge a complaint with a supervisory authority against the controller or processor responsible for the alleged infringement. Article 79 provides them with a right to an effective judicial remedy against the controller or processor of the alleged infringement. Can both of these routes be pursued simultaneously? Is a supervisory authority permitted to reject a complaint because court proceedings concerning the same matter have already been initiated? What about if those proceedings are still pending? These are the questions addressed by the Court of Justice in the recent judgment in Case-414/24.

In this judgment, the CJEU confirmed that data subjects may pursue both a complaint to a supervisory authority and also court proceedings simultaneously and held that national procedural rules cannot deprive data subjects of either remedy. Member States may however adopt measures to prevent inconsistent outcomes, provided they comply with the principles of effectiveness and equivalence.

Background to case

The preliminary reference in this case arose from Austrian proceedings in which a doctor sought the erasure of personal data from an online doctor rating platform and, following the controller’s refusal, pursued both court proceedings and a complaint to the Austrian Data Protection Authority under Article 77 GDPR. The Data Protection Authority rejected the complaint on the basis that the matter was already before the civil courts. The Austrian Supreme Administrative Court referred questions to the CJEU asking whether a supervisory authority may refuse to examine a complaint where parallel judicial proceedings concerning the same alleged GDPR infringement are already pending.

Question asked

The referring court asked the CJEU whether Articles 77 and 79 GDPR permit a supervisory authority to reject a complaint on the basis that the data subject has already commenced judicial proceedings concerning the same subject matter and those proceedings remain pending. It also asked whether the position would be different where a substantive judgment had already been delivered in those proceedings but had not yet become final. The CJEU answered both questions in the negative. It held that the remedies provided by Articles 77 and 79 GDPR are independent and may be exercised simultaneously. Therefore, a supervisory authority cannot reject a complaint solely because parallel judicial proceedings relating to the same alleged infringement have been initiated, even where a decision has already been delivered and is subject to appeal.  

In reaching its decision the CJEU noted that under Article 57(1)(f) GDPR, a supervisory authority is required to handle complaints and, if it concludes that the GDPR has been infringed and that its corrective powers under Article 58(2) GDPR are capable of remedying that infringement, it must act. That duty to intervene would be undermined if the supervisory authority were prevented from acting in relation to an infringement solely because judicial proceedings were still pending and the court’s decision had not yet become final.

Risk of inconsistent outcomes

The referring court, and the Austrian Data Protection Authority, had expressed concern that permitting a complaint before a supervisory authority to proceed in parallel with court proceedings concerning the same subject matter could lead to conflicting or contradictory decisions, thus undermining legal certainty. In responding to this concern, the CJEU noted that Member States may introduce procedural coordination mechanisms (for example, the suspension of administrative proceedings until civil proceedings has been decided) to avoid the risk of inconsistent decisions, but those rules must not undermine the effective protection of data subjects’ rights under the GDPR.

Nemzeti Adatvédelmi és Információszabadság Hatóság, C‑132/21

In reaching its decision the Court relied to a large extent on its earlier judgment in Nemzeti Adatvédelmi és Információszabadság Hatóság (C‑132/21), in which it had confirmed that the remedies provided by Articles 77 and 79 GDPR are concurrent and independent. In Nemzeti, the CJEU held that the GDPR does not grant priority on either supervisory authority proceedings or court proceedings and so data subjects are entitled to pursue both avenues.

What does this mean for Ireland

The judgment confirms that the Data Protection Commission cannot refuse to consider an Article 77 GDPR complaint solely because parallel court proceedings concerning the same alleged infringement are pending, confirming that a data subject may pursue both a complaint to the DPC and a data protection action simultaneously. While procedural measures may be put in place to manage the risk of inconsistent outcomes, the existence of court proceedings cannot, of itself, deprive a data subject of the right to pursue a complaint before the DPC. While no formal mechanisms have been put in place in Ireland to deal with such scenarios, the DPC notes on its website in relation to complaints handling that it is open to a data subject to make an application to court under section 117 of the Data Protection Act 2018 “at all stages”, stating however that “the DPC may have to suspend or conclude its examination [of a complaint] if that examination would interfere in any way with parallel court proceedings”¹

Conclusion

This decision will be disappointing for data controllers. The fact that data subjects are entitled to pursue both a complaint to a supervisory authority and civil proceedings at the same time means that organisations may find themselves simultaneously dealing with proceedings before the court and with the DPC, in connection with the same alleged GDPR breach, creating a burden in terms of resources, cost and risk. Businesses should ensure that their litigation and regulatory response strategies are closely coordinated and should be live to the interplay between the two processes.