{"id":86824,"date":"2026-07-02T16:25:04","date_gmt":"2026-07-02T14:25:04","guid":{"rendered":"https:\/\/www.lexxion.eu\/?post_type=dpi&p=86824"},"modified":"2026-07-02T16:25:17","modified_gmt":"2026-07-02T14:25:17","slug":"data-protection-insider-issue-156","status":"publish","type":"dpi","link":"https:\/\/www.lexxion.eu\/en\/dpi\/data-protection-insider-issue-156\/","title":{"rendered":"Data Protection Insider, Issue 156"},"content":{"rendered":"

Table of Contents:<\/strong><\/p>\n

    \n
  1. CJEU rules on the possibility for a supervisory authority to reject a complaint also brought before a judicial body<\/a><\/li>\n
  2. CJEU rules on personal data processing in judicial proceedings<\/a><\/li>\n
  3. AG Norkus: Individuals contributing to evaluative judgments are not sources of data<\/a><\/li>\n
  4. European Commission proposes upgrades to the Europol and Eurojust Regulations and the data protection rules in the AFSJ in Regulation 2018\/1725<\/a><\/li>\n
  5. EDPB releases new documents<\/a><\/li>\n<\/ol>\n

     <\/p>\n

    In the present edition, we discuss two CJEU judgments, and one AG Opinion on different aspects of the GDPR. In addition, we present a list of the newest legislative proposals in the field of data protection and EDPB documents.<\/p>\n

    CJEU rules on the possibility for a supervisory authority to reject a complaint also brought before a judicial body<\/h2>\n

    [1]<\/a> On 18th June, the CJEU ruled in the case of Datenschutzbeh\u00f6rde<\/em>. In terms of the facts, the case essentially concerned a physician, who requested from a \u201csearch platform enabling third parties to provide reviews and testimonials on physicians\u2026the erasure of certain personal data concerning her, on the basis of the legal situation prior to the entry into force of the GDPR\u201d. This request was rejected by the platform. Consequently, the physician complained before the civil courts, and to the DPA. The DPA rejected the complaint on the basis that the \u201ccomplaint and the civil action\u2026related to the same subject matter, namely the erasure of personal data concerning\u201d her \u201cas published on that platform\u201d. In this regard, the DPA considered that \u201cthe parallel or successive conduct of proceedings before a supervisory authority and judicial proceedings would, from a systematic perspective, be inconsistent with the remedial mechanism provided for under the GDPR. In its view, in such a situation, the supervisory authority would have to rule on the same question as that referred to the civil court\u201d. The DPA further considered that \u201cthe concurrent exercise of the right to lodge a complaint with the supervisory authority and of the right to a judicial remedy concerning the same subject matter cannot be permitted\u201d. This led to proceedings in front of the national courts, culminating in proceedings before the Verwaltungsgerichtshof (Supreme Administrative Court), which referred two questions to the CJEU. The Court summarized these as follows: do \u201cArticle 77(1) and Article 79(1) of the GDPR\u201d preclude \u201ca supervisory authority, with which a complaint has been lodged under Article 77(1)\u2026from rejecting that complaint on the sole ground that judicial proceedings under Article 79(1)\u2026concerning the same subject matter, have already been brought and even though the decision given in those proceedings is not yet final\u201d. The Court ruled that the Articles in question \u201cmust be interpreted as precluding a supervisory authority, with which a complaint has been lodged under Article 77(1)\u2026from rejecting\u201d a \u201ccomplaint on the sole ground that judicial proceedings under Article 79(1)\u2026concerning the same subject matter, have already been brought and even though the decision given in those proceedings is not yet final\u201d. In this regard the Court highlighted that the grounds of complaint have been designed such as to potentially be brought concurrently, and that should they be allowed to function otherwise, this may result in diminished protection for the data subject. Interestingly, the Court did, in principle, however, recognise the possibility for supervisory authorities to be allowed to suspend cases also pending before judicial fora.<\/p>\n

     <\/p>\n

    CJEU rules on personal data processing in judicial proceedings<\/h2>\n

    [2]<\/a> On 18th June, the CJEU ruled in the case of NTH Haustechnik GmbH<\/em>. In terms of the facts, the case essentially concerned a company employee who sold goods allegedly belonging to the company on eBay \u2013 the employee denies the goods belonged to the company. The company discovered this by accessing the employee\u2019s eBay account via the use of their ID and password \u2013 precisely how this happened remains the subject of debate \u2013 an act of processing personal data which the referring national court accepts may have been unlawful. In this regard, the referring court was unsure as to a number of questions related to the processing of such personal data in the context of judicial proceedings, and accordingly requested clarification from the CJEU. The CJEU considered the following six questions:<\/p>\n