Regulatory Watch  /  Austria  /  Court ruling
Moderate impactCourt rulingDecided

CJEU rules Austrian DPA cannot limit data subject complaints to two per month

The Court of Justice of the EU (CJEU) in case C-416/23 held that the Austrian Data Protection Authority (DSB) may not cap the number of complaints a data subject can file. The judgment confirms that users have the right to have any GDPR violation remedied, provided the complaints are not abusive. The ruling highlights ongoing EU‑wide concerns about DPA inactivity and procedural delays.

Why it matters: The decision reinforces individuals' rights to file multiple GDPR complaints and pressures DPAs to enforce the law more effectively.

Summary generated from the sources below. Check the primary source before relying on it; this is not legal advice.

Sources
Austrian data protection authority slammed by CJEU
noyb · primary source · Jan 9, 2025
Austrian data protection authority slammed by CJEU
noyb · Jan 9, 2025
Details
JurisdictionAustria
RegulatorAustrian Data Protection Authority (DSB)
CourtCourt of Justice of the European Union (CJEU)
LawGeneral Data Protection Regulation
CaseC-416/23
StatusDecided
PublishedJanuary 9, 2025
Effectivenot stated
OrganisationsAustrian Data Protection Authority (DSB), Austrian Data Protection Authority
Topicsconsent, deletion, privacy, data governance, cross border transfer, cookies
Datapersonal