Joris DeeneAnyone who believes that their personal data has been processed unlawfully has two options: filing a complaint with the supervisory authority and bringing a civil action. But what if the data subject pursues both ways at the same time? In the ruling of June 18, 2026 (C-414/24, Data Protection Authority) the Court of Justice rules that a supervisory authority may not simply dismiss a complaint on the sole ground that the same matter is already pending before a court. The complaint must be addressed, if necessary after being suspended pending the court’s decision.
The facts
In 2017, a doctor asked the operator of an online doctor-review platform to delete her personal data. When this request was denied, she filed a civil lawsuit against the platform in November 2017, seeking, among other things, the deletion of the data and a cease to its further processing.
After the entry into force of the General Data Protection Regulation (GDPR) she reiterated her request for erasure. That request was also denied. She then filed a complaint with the Austrian Data Protection Authority in July 2018, based on the right to erasure under Article 17 of the GDPR. The subject matter of that complaint was identical to that of the civil action: the erasure of the same data on the same platform.
The supervisory authority dismissed the complaint. In its view, the framework of the GDPR is incompatible with the simultaneous or sequential pursuit of an administrative complaint procedure and judicial proceedings regarding the same matter. Furthermore, the Austrian constitutional principle of the separation of judicial and executive powers prohibits both bodies from ruling on the same dispute. The matter was referred to the Court of Justice via the Austrian Supreme Administrative Court.
The decision
The Court rules that Article 77(1) and Article 79(1) of the GDPR preclude a supervisory authority from rejecting a complaint on the sole ground that legal proceedings on the same subject matter have already been initiated, even if the court’s decision in those proceedings is not yet final.
The Court builds on its previous case law. In the ruling National Authority for Data Protection and Freedom of Information (ECJ, January 12, 2023, C-132/21) it had already held that the remedies provided for in Articles 77 through 79 of the GDPR may be exercised concurrently and independently of one another. The Regulation does not provide for any priority or exclusive jurisdiction, nor does it grant the supervisory authority or the court any rule of priority in assessing an alleged infringement. Each remedy must be available “without prejudice” to the others, as the preamble to the three provisions expressly states.
That interpretation is supported by the context and objectives of the Regulation. Pursuant to Article 57(1)(f) of the GDPR, each supervisory authority must handle complaints with due diligence and care. The complaints procedure is, as the Court emphasized in its SCHUFA Holding ruling (Court of Justice, December 7, 2023, C-26/22 and C-64/22) that this is not a non-binding request that the authority may choose to disregard at its discretion, but rather a mechanism designed to effectively protect the rights and interests of the data subject. The supervisory authority is required to take action when a corrective measure under Article 58(2) of the GDPR is appropriate, necessary, and proportionate.
It follows from this duty of care that, when handling a complaint, the authority must take into account the outcome of parallel judicial proceedings concerning the same matter. To this end, the Court offers an alternative: instead of dismissing the complaint, a Member State may provide for a suspension mechanism. The authority would then suspend the investigation until the court’s decision is final. This reconciles the right to an effective remedy with the need to avoid conflicting decisions.
A mere rejection does not satisfy this requirement. If the authority rejects the complaint while the judicial proceedings are still pending, it has no certainty that a decision on the merits will ever be rendered: the claim may be declared inadmissible on procedural grounds, or the person concerned may withdraw it. Furthermore, if national law subjects the filing of a new complaint to a statute of limitations and that period has since expired, the person concerned risks losing any effective protection. This is contrary to the principle of effectiveness.
Legal analysis and interpretation
The "rejection versus suspension" dichotomy as the core of the ruling
The added value of this ruling lies not in the confirmation of the parallel nature of the appeal procedures—which has been established since Nemzeti Adatvédelmi—but in the sharp distinction between two procedural techniques that ostensibly serve the same purpose. Both dismissal and suspension can prevent conflicting decisions, but only suspension respects the independence of the complaint procedure.
The reasoning is internally consistent. The Court links the duty of care under Article 57(1), (f) and the duty to act derived from SCHUFA case law directly to the procedural outcome of the complaint: an authority that rejects a complaint relieves itself of its duty to investigate on the basis of a future event that may never occur. Suspension, on the other hand, maintains the duty and merely postpones its exercise. The definitive or non-definitive nature of the judicial decision thus becomes decisive—a point on which the Advocate General explicitly distanced himself in this case from the Commission’s contrary position.
The analogy with Article 81 of the GDPR and its limitations
The referring court drew inspiration from the suspension mechanism set forth in Article 81(2) and (3) of the GDPR, which applies a priority rule: the body to which the request was last submitted must yield. However, that provision was drafted for cross-border situations in which proceedings in different Member States overlap. The Regulation does not provide for a harmonized solution in the case of conflicting decisions within a single Member State.
That is precisely where procedural autonomy comes into play. The Court confirms that it is up to each Member State to determine the coordination between legal remedies, provided that the principles of equivalence and effectiveness, as well as Article 47 of the Charter, are respected. Austria’s decision to derive an obligation to reject appeals from the principle of separation of powers is not invalidated because of the separation of powers as such, but because the chosen method—rejection—undermines the practical effect of the right to complain. The message is methodological: a Member State may coordinate, but the chosen method must be the least intrusive one that achieves the objective.
Specifically, what does this mean?
For the Belgian Data Protection Authority. The Litigation Chamber cannot simply dismiss a complaint on the grounds that the complainant has already filed a claim with a civil court regarding the same facts. Belgian law does not expressly provide for a suspension mechanism between a complaint under Article 77 of the GDPR and a claim under Article 79 of the GDPR. Until the legislature addresses this, the Litigation Chamber will have to reconcile its duty to investigate with the ruling: it must either proceed with the case or, de facto, suspend it pending the final judgment, but it may not dismiss it. A dismissal based solely on pending legal proceedings risks being overturned by the Market Court on the grounds of a violation of the principle of effectiveness.
For individuals who wish to assert their rights. Both avenues remain fully open. Anyone who takes their case to court does not lose the right to file a complaint with the regulatory authority, and vice versa. However, it is advisable to consider the two options strategically: the complaint procedure is accessible and free of charge, while a legal action allows for a judgment and, potentially, compensation. When filing a complaint, pay close attention to the admissibility requirements and the factual basis, because the ruling protects the right to have the complaint heard, not the merits of the case.
For the data controller as the defendant. The downside is that the same decision can now be challenged on two fronts simultaneously, with the associated burden and costs of a dual defense. The Advocate General explicitly acknowledged this disadvantage. Defendants facing a parallel complaint and claim may have an interest in actively bringing the pending court proceedings to the attention of the Litigation Chamber and urging it to suspend the proceedings rather than proceed with a simultaneous substantive hearing.
Frequently asked questions (FAQ)
Can I file a complaint with the data protection authority and take the matter to court at the same time?
Yes. The GDPR provides for remedies that can be pursued concurrently and independently of one another. Filing a complaint with the supervisory authority does not preclude bringing a legal action, and vice versa.
Can the regulator reject my complaint because a lawsuit is already pending?
No, not on that basis alone. The authority must handle the complaint. It may suspend the investigation until the court’s decision is final, but it may not simply dismiss the complaint.
What happens if the judge has already dismissed my claim, but the judgment is not yet final?
Even in that case, the regulator may not dismiss the complaint. As long as the court’s decision can still be appealed, the risk of conflicting rulings remains purely hypothetical, and the complaint must be processed in the usual manner.
Conclusion
The ruling strengthens the position of the person concerned. The complaint filed with the supervisory authority and the claim brought before the court are two separate avenues that cannot be pitted against one another. A regulatory authority faced with a concurrent proceeding may not dismiss the complaint solely on the grounds that the same matter is already pending before a court; it must proceed with the complaint, if necessary after suspending it until the judgment becomes final. In Belgian practice, this means that a dismissal by the Litigation Chamber due to pending legal proceedings is vulnerable to challenge before the Market Court.
Dutch 
English