Executive Summary:
- CJEU: DPAs are Data Controllers
- CJEU Rules on Personal Data Processing in Smart Meters
- AG Opinion on the Concept of Personal Data and Non-Material Damage in relation to Dynamic IP Addresses
- EDPS Releases New Opinion on EU-US Data Transfers
- EDPB Launches “Privacy for Kids”
In the present edition, we inform our readers of one CJEU judgment concerning the obligations of DPAs to comply with data subject access requests; another CJEU judgment on smart meters; an AG Opinion on the concept of personal data and non-material damage in relation to dynamic IP addresses; and new EDPB and EDPS documents.
CJEU: DPAs are Data Controllers
[1] On 5th November, the CJEU held in Lindenberg v Bayerisches Landesamt für Datenschutzaufsicht that a DPA is a controller for the processing of the personal data of individuals who submit complaints with that DPA, and that a fortiori, DPAs have to grant access to the concerned individuals to the personal data they process about them, unless a restriction which complies with the GDPR and the CFREU is applicable. As to the facts of the case, the applicant in the main proceedings (Mr. Lindenberg) submitted several complaints with the Bavarian DPA. He was informed of the enforcement action taken in relation to one complaint. He then requested access to the file related to that complaint on the basis of the right of access to his data in Article 15 GDPR. The DPA first turned down the request with the explanation that the Bavarian legal framework regulating DPAs explicitly prohibits access to the any information in the documents held by DPAs (Paragraph 20(2) of the BayDSG). When Mr Lindenberg filed suit in Germany against the decision, the DPA decided to provide access, but clarified that it is not obliged to do so and it is doing this only exceptionally. Mr Lindenberg nevertheless pursued his complaint further, because he was concerned that the contested Bavarian provision is not compatible with the GDPR. The dispute resulted in two preliminary questions: (1) whether a DPA is a controller in the sense of the GDPR and is thus subject to the controller obligations, amongst which receiving requests on the basis of the data subject rights, and (2) whether Paragraph 20(2) of the BayDSG, which prohibits in general any access to any information in the DPA documents, is compatible with the GDPR. On the first question, the CJEU ruled that when DPAs process personal data, including those contained in complaints, they act as a controller and are thus subject to all the requirements in the GDPR. As a consequence, complainants (and other data subjects) may in principle request access to their data on the basis of the right of access to one’s data as anchored in Article 15 GDPR, but not to the full documentation file on that legal basis. As to the second question, the CJEU established that exceptions to the right of access may be anchored in national law, but only in so far they comply with the requirements of Article 23 (1)(c), (h) and (i) GDPR, especially relating to legitimate purpose, necessity and proportionality.
CJEU Rules on Personal Data Processing in Smart Meters
[2] On 5th November 2026, the CJEU ruled in the case of SR v Netz Niederösterreich GmbH. In terms of the facts, the case essentially concerned an individual, whose electricity meter was due for replacement, and who was thus due to receive a smart mater. This individual then refused to provide permission for the installation of the smart meter. The electricity company thus took the individual to court to force the installation. This marked the start of a series of disputes before the local courts. In this regard, the referring court posed several questions to the CJEU regarding the legal status of smart meters and their installation. In this regard, the Court considered two questions related to the processing of personal data via smart meters. 1: Does Article 2(1) of Directive 2014/32, in light of Articles 20(1)(b) and (c) and Article 23(3) of Directive 2019/944, prohibit the possibility of national legislation according to which the concept of a “smart meter” is defined, without simultaneously requiring, in that definition, appropriate data security in relation to data transferred by smart meters? 2: Does Article 5(3) of Directive 2002/58 – the e-Privacy Directive – mean its conditions relating to the storage of information in the terminal equipment of an end user, or access to the information stored in the terminal equipment of an end user, should also be applied in relation to an electricity system through which personal data are also transferred? In relation to the first question, the Court concluded that there was no reason that such national legislation should be regarded as legally problematic, provided that relevant data security and data protection obligations on smart devices, as elaborated in EU law, were provided for in national legislation applicable to the use of intelligent energy measurement systems. In relation to the second question, the Court concluded that the provisions in question could not be seen to apply to an electricity network, through which personal data are transferred, on the basis of the fact that such a network could not be considered as a public communications network within the meaning of the relevant law. The Court reached this conclusion despite the existence of a Recital indicating the contrary – Recital 16 of Implementing Regulation 2023/1162.
AG Opinion on the Concept of Personal Data and Non-Material Damage in relation to Dynamic IP Addresses
[3] On 5th November, AG Maciej Szpunar published their Opinion in the case of US, DR v. KY. In terms of the facts, the case essentially concerned the transmission, to Google in the US, as part of the use of Google’s services by a website operator, of information on users’ dynamic IP addresses. In relation to this, one party, the defendant, requested compensation, which was paid. On finding out that the defendant had engaged in activities such as to be able to request compensation in an automated and repeated manner in relation to many websites, the applicant complained to national courts. In this regard, the AG considered three questions referred by the national courts. 1. Does Article 4(1) GDPR mean a dynamic IP address which is transmitted, automatically, by a website operator, is personal data if a third party has the information necessary to identify the data subject, or if the controller or recipient of the data has means available which could reasonably be used to identify the data subject, and, if the latter should be found to be the case, if legal means of identification is adequate, or whether the conditions for the application of such legal means must also be met? 2. Does Article 82(1) GDPR recognise the existence of non-material damage where a data subject has deliberately caused an infringement, in an automated and repeated way, aimed at obtaining compensation? 3. Does Article 82(1) GDPR exclude a victim of non-material damage from obtaining compensation where accepting such a claim would violate the general principle that individuals may not fraudulently or abusively make use of EU laws, and if this is so, under which conditions would this be the case? In relation to the first question, the AG considered that a dynamic IP address automatically transmitted to a third party with the means which might reasonably be used to identify the data subject, by a website operator, would constitute directly identifiable personal data for the third party, and indirectly identifiable personal data for the website operator, if the operator knows, or should have known, this was the case. In relation to the second question, the AG considered that Article 82(1) means non-material damage cannot be seen to exist where the data subject has behaved in a manner such as to automatically and repeatedly cause infringements to obtain compensation. In relation to the third question, the AG considered that Article 82(1) precludes compensation where this would violate the principle that EU law should not be used fraudulently or abusively, where identifying abuse relies on: the identification of objective circumstances which show that, although formal compliance with EU law is apparent, the intention of the law has been violated; and the identification of intentionality with regard to obtaining advantage under law by creating the conditions for such advantage to accrue – where, significantly, it is not important whether this intention is the only aim, but rather the main aim, of the actions in question.
EDPS Releases New Opinion on EU-US Data Transfers
[4] On 29th October, the EDPS released a new Opinion on the Commission’s Proposal for data exchange between the EU and the US in the field of border checks and migration. As summarised by the EDPS: the “proposed arrangement would facilitate identity verification, screening and vetting of travellers to determine whether their entry would pose a serious and genuine risk to public security or public order. The US has made it a requirement for partner countries in the US Visa Waiver Program to conclude an ‘Enhanced Border Security Partnership’ with the US Department of Homeland Security by the end of 2026, which is why the Commission proposes provisional application before this agreement officially enters into force.” Due to the sensitive nature of the data and the context, in the Opinion, the EDPS has focused especially on the necessary safeguards for the rights of the concerned individuals.
EDPB Launches “Privacy for Kids”
[5] On 4th November, the EDPB announced the launching of “a new hub for parents, teachers, and educators. It provides engaging and children friendly resources such as games, videos and quizzes, to understand online privacy”. The announcement on the EDPB website provides the links to different educational materials posted by the national DPAs.
More Information:
[1] https://infocuria.curia.europa.eu/tabs/document/C/2025/C-0205-25-00000000RP-01-P-01/ARRET/328893-EN-1-html
[2] https://infocuria.curia.europa.eu/tabs/affair?lang=en&publishedId=C-468%2F24&searchTerm=C%252D468%252F24
[3] https://infocuria.curia.europa.eu/tabs/affair?lang=en&publishedId=C-654%2F25&searchTerm=C%252D654%252F25
[4] https://www.edps.europa.eu/press-publications/press-news/press-releases/2026/eu-us-border-information-exchange-effective-safeguards-are-essential-protect-fundamental-rights-practice_en
[5] https://www.edpb.europa.eu/news/edpb-helps-kids-stay-safe-online_en