Background
Dr. G S, an Austrian physician, sought erasure of personal data published about her on Company D’s physician-review platform. After Company D rejected her erasure request in July 2017 and again in July 2018, she pursued two tracks simultaneously: a civil court action filed in November 2017 (predating the GDPR’s application), and a formal complaint lodged with the Austrian Data Protection Authority (Datenschutzbehörde, “DSB”) in July 2018 under Article 77(1) GDPR, invoking the Article 17 right to erasure.
The DSB rejected her complaint by decision of 4 January 2019, reasoning that the pending civil proceedings and the administrative complaint concerned the same subject matter — erasure of her personal data — and that the concurrent exercise of both remedies was incompatible with the GDPR’s remedial structure. Underlying this position was a principle embedded in Austrian constitutional law (Paragraph 94(1) of the Federal Constitutional Law) requiring that a dispute be assigned in its entirety either to the courts or to the administrative authorities, precluding parallel or successive rulings on the same dispute by both branches.
Dr. G S’s challenge to the DSB’s rejection worked its way through the Austrian administrative court hierarchy. The Federal Administrative Court upheld the rejection on a different ground — a one-year limitation period under national law — while also finding the DSB’s “same subject matter” rationale inconsistent with the GDPR’s directly applicable parallel-remedy framework. Both Dr. G S and the DSB appealed to the Verwaltungsgerichtshof (Supreme Administrative Court), which doubted the time-bar analysis and referred two questions to the Court of Justice concerning whether a complaint may be rejected when judicial proceedings on the same subject are pending, and whether the result differs once a (non-final) merits judgment has been rendered.
The Court’s Holding
The Court of Justice, taking the two referred questions together, held that Articles 77(1) and 79(1) GDPR must be interpreted as precluding a national supervisory authority from rejecting a data subject’s Article 77 complaint on the sole ground that an Article 79 judicial remedy concerning the same subject matter has already been pursued and proceedings remain pending — even if a non-final merits judgment has already been delivered in those proceedings. The “without prejudice” language connecting all three remedies in Articles 77–79 reflects a deliberate legislative choice that these avenues are concurrent and independent, with no priority or exclusive competence assigned to either branch.
The Court reaffirmed that under Article 57(1)(f) GDPR, each supervisory authority is legally obligated to handle complaints with due diligence and investigate them to the extent appropriate. Allowing outright rejection on the basis of pending litigation would strip data subjects of the protection that mechanism is designed to provide, particularly where civil proceedings might ultimately be dismissed on procedural grounds without any merits ruling. The supervisory authority must, however, take into account any decision that definitively closes judicial proceedings when examining the complaint.
The Court acknowledged the legitimate concern about contradictory decisions within a single Member State and observed — without mandating a specific solution — that Member States may, within their procedural autonomy, establish suspension mechanisms allowing (or requiring) a supervisory authority to pause proceedings while parallel litigation is pending. What Member States may not do is permit outright rejection, which would render the Article 77 complaint remedy practically ineffective and fall below the minimum standard set by the principles of effectiveness and effective judicial protection under Article 47 of the Charter.
Key Takeaways
- GDPR Articles 77 and 79 create genuinely concurrent and independent remedies; neither remedy is subordinate to, or displaced by, the other, and no rule of precedence exists under EU law between administrative complaints and civil court actions.
- A national data protection authority is obligated under Article 57(1)(f) GDPR to handle and investigate complaints with due diligence and cannot automatically defer that obligation simply because litigation on the same facts is underway — including after a non-final court judgment on the merits.
- Member States retain procedural autonomy to manage the parallel-remedy relationship, but only through mechanisms — such as staying supervisory proceedings — that preserve the data subject’s access to both avenues; outright rejection of a complaint fails the EU law principles of effectiveness and equivalence.
- The supervisory authority must account for any final judicial decision when it ultimately rules on a complaint, ensuring coherence without sacrificing the data subject’s right to administrative protection.
Why It Matters
This ruling resolves a practical tension that has arisen in several Member States where constitutional or procedural traditions disfavour parallel adjudication of the same dispute by courts and administrative bodies. By firmly excluding outright rejection as an option, the Court of Justice protects the full remedial architecture that the GDPR deliberately constructed: data subjects can simultaneously pursue supervisory-authority complaints and civil litigation without losing one path because they chose the other. This is particularly significant in complex data-processing disputes where civil courts and data protection authorities bring different investigative tools and corrective powers to bear.
The decision also offers practical guidance to national legislators: the approved route to managing parallel proceedings is a suspension mechanism, not a jurisdiction rule that extinguishes one track entirely. Data protection authorities across the EU should review their procedural rules — and the national laws underpinning them — to ensure that admissibility criteria do not replicate the Austrian approach struck down here. For data subjects and their counsel, the judgment confirms that commencing civil litigation does not forfeit the right to lodge a regulatory complaint, preserving strategic flexibility in enforcement.