{"attribution":{"source":"legal.exploreworldai.com","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-768-21","cite_as":"NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-768-21)","license":"https://legal.exploreworldai.com/revision","version":"legal-2026-10-20","fingerprint":"ewai:eu:cf0e00","proof":"sha256:0b4c67dfbc7299582edd6147c6c9af28f213f9c162e81e9a1dde0e955fefaca8","jurisdiction":"eu","lang":"en","publisher":"NovaCopilot by ExploreWorld Legal","terms":"https://legal.exploreworldai.com/om"},"brand_source":"Source: NovaCopilot","item":{"schema_version":"1.0.0","id":"eu:c-768-21","jurisdiction":"eu","lang":"en","brand_source":"Source: NovaCopilot","brand":{"product":"NovaCopilot","platform":"ExploreWorldAI","infrastructure":"ExploreWorld Legal","infrastructure_url":"legal.exploreworldai.com","legal_entity":"Valkiv Ventures AB","permanent_url":"https://legal.exploreworldai.com/novacopilot","source":"Source: NovaCopilot","powered_by":"Powered by NovaCopilot","license":"https://legal.exploreworldai.com/licensvillkor"},"sections":[{"title":"62021CJ0768","paragraphs":[]},{"title":"JUDGMENT OF THE COURT (First Chamber)","paragraphs":[]},{"title":"26 September 2024 (\n *1\n )","paragraphs":["para_4","para_5","para_6"]},{"title":"TR","paragraphs":["para_8","para_9","para_10","para_11","para_12","para_13","para_14","para_15","para_16","para_17","para_18","para_19","para_20","para_21","para_22","para_23","para_24","para_25","para_26","para_27","para_28","para_29","para_30","para_31"]},{"title":"Judgment","paragraphs":[]},{"title":"1","paragraphs":["para_34"]},{"title":"2","paragraphs":["para_36"]},{"title":"Legal context","paragraphs":[]},{"title":"3","paragraphs":[]},{"title":"Under recitals 6, 7, 10, 129 and 148 of the GDPR:","paragraphs":["para_40","para_41"]},{"title":"(7)","paragraphs":["para_43","para_44"]},{"title":"(10)","paragraphs":["para_46","para_47"]},{"title":"(129)","paragraphs":["para_49","para_50"]},{"title":"(148)","paragraphs":["para_52"]},{"title":"4","paragraphs":[]},{"title":"Article 5 of that regulation reads as follows:","paragraphs":["para_55"]},{"title":"(a)","paragraphs":["para_57"]},{"title":"(b)","paragraphs":["para_59"]},{"title":"(c)","paragraphs":["para_61"]},{"title":"(d)","paragraphs":["para_63"]},{"title":"(e)","paragraphs":["para_65"]},{"title":"(f)","paragraphs":["para_67","para_68"]},{"title":"5","paragraphs":[]},{"title":"Article 24(1) of that regulation provides:","paragraphs":["para_71"]},{"title":"6","paragraphs":[]},{"title":"Article 33 of that regulation provides:","paragraphs":["para_74","para_75"]},{"title":"3.   The notification referred to in paragraph 1 shall at least:","paragraphs":[]},{"title":"(a)","paragraphs":["para_78"]},{"title":"(b)","paragraphs":["para_80"]},{"title":"(c)","paragraphs":["para_82"]},{"title":"(d)","paragraphs":["para_84","para_85"]},{"title":"7","paragraphs":[]},{"title":"Article 34(1) of the GDPR states:","paragraphs":["para_88"]},{"title":"8","paragraphs":["para_90"]},{"title":"9","paragraphs":[]},{"title":"Article 51(1) of that regulation is worded as follows:","paragraphs":["para_93"]},{"title":"10","paragraphs":[]},{"title":"Article 57 of the GDPR, entitled ‘Tasks’, provides, in paragraph 1 thereof:","paragraphs":["para_96"]},{"title":"(a)","paragraphs":["para_98","para_99"]},{"title":"(f)","paragraphs":["para_101","para_102"]},{"title":"11","paragraphs":[]},{"title":"Article 58 of that regulation, entitled ‘Powers’, provides, in paragraphs 1 and 2 thereof:","paragraphs":["para_105"]},{"title":"(a)","paragraphs":["para_107","para_108"]},{"title":"2.   Each supervisory authority shall have all of the following corrective powers:","paragraphs":[]},{"title":"(a)","paragraphs":["para_111"]},{"title":"(b)","paragraphs":["para_113"]},{"title":"(c)","paragraphs":["para_115"]},{"title":"(d)","paragraphs":["para_117"]},{"title":"(e)","paragraphs":["para_119"]},{"title":"(f)","paragraphs":["para_121","para_122"]},{"title":"(i)","paragraphs":["para_124","para_125"]},{"title":"12","paragraphs":[]},{"title":"Article 77 of that regulation reads as follows:","paragraphs":["para_128","para_129"]},{"title":"13","paragraphs":[]},{"title":"Article 83(1) and (2) of that regulation provides:","paragraphs":["para_132","para_133"]},{"title":"(a)","paragraphs":["para_135"]},{"title":"(b)","paragraphs":["para_137"]},{"title":"(c)","paragraphs":["para_139"]},{"title":"(d)","paragraphs":["para_141"]},{"title":"(e)","paragraphs":["para_143"]},{"title":"(f)","paragraphs":["para_145"]},{"title":"(g)","paragraphs":["para_147"]},{"title":"(h)","paragraphs":["para_149"]},{"title":"(i)","paragraphs":["para_151"]},{"title":"(j)","paragraphs":["para_153"]},{"title":"(k)","paragraphs":["para_155"]},{"title":"The dispute in the main proceedings and the question referred for a preliminary ruling","paragraphs":[]},{"title":"14","paragraphs":["para_158"]},{"title":"15","paragraphs":["para_160"]},{"title":"16","paragraphs":["para_162"]},{"title":"17","paragraphs":["para_164"]},{"title":"18","paragraphs":["para_166"]},{"title":"19","paragraphs":["para_168"]},{"title":"20","paragraphs":["para_170"]},{"title":"21","paragraphs":["para_172"]},{"title":"22","paragraphs":["para_174"]},{"title":"23","paragraphs":["para_176","para_177"]},{"title":"Admissibility of the request for a preliminary ruling","paragraphs":[]},{"title":"24","paragraphs":["para_180"]},{"title":"25","paragraphs":["para_182"]},{"title":"26","paragraphs":["para_184"]},{"title":"27","paragraphs":["para_186"]},{"title":"28","paragraphs":["para_188"]},{"title":"29","paragraphs":["para_190"]},{"title":"Consideration of the question referred","paragraphs":[]},{"title":"30","paragraphs":["para_193"]},{"title":"31","paragraphs":["para_195"]},{"title":"32","paragraphs":["para_197"]},{"title":"33","paragraphs":["para_199"]},{"title":"34","paragraphs":["para_201"]},{"title":"35","paragraphs":["para_203"]},{"title":"36","paragraphs":["para_205"]},{"title":"37","paragraphs":["para_207"]},{"title":"38","paragraphs":["para_209"]},{"title":"39","paragraphs":["para_211"]},{"title":"40","paragraphs":["para_213"]},{"title":"41","paragraphs":["para_215"]},{"title":"42","paragraphs":["para_217"]},{"title":"43","paragraphs":["para_219"]},{"title":"44","paragraphs":["para_221"]},{"title":"45","paragraphs":["para_223"]},{"title":"46","paragraphs":["para_225"]},{"title":"47","paragraphs":["para_227"]},{"title":"48","paragraphs":["para_229"]},{"title":"49","paragraphs":["para_231"]},{"title":"50","paragraphs":["para_233"]},{"title":"Costs","paragraphs":[]},{"title":"51","paragraphs":["para_236"]},{"title":"On those grounds, the Court (First Chamber) hereby rules:","paragraphs":["para_238","para_239","para_240","para_241"]}],"paragraphs":[{"text":"62021CJ0768","paragraph_id":"para_1"},{"text":"JUDGMENT OF THE COURT (First Chamber)","paragraph_id":"para_2"},{"text":"26 September 2024 (\n *1\n )","paragraph_id":"para_3"},{"text":"(Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 57(1)(a) and (f) – Tasks of the supervisory authority – Article 58(2) – Corrective powers – Administrative fine – Discretion of the supervisory authority – Limits)","paragraph_id":"para_4"},{"text":"In Case C‑768/21,","paragraph_id":"para_5"},{"text":"REQUEST for a preliminary ruling under Article 267 TFEU from the Verwaltungsgericht Wiesbaden (Administrative Court, Wiesbaden, Germany), made by decision of 10 December 2021, received at the Court on 14 December 2021, in the proceedings","paragraph_id":"para_6"},{"text":"TR","paragraph_id":"para_7"},{"text":"v","paragraph_id":"para_8"},{"text":"Land Hessen,","paragraph_id":"para_9"},{"text":"THE COURT (First Chamber),","paragraph_id":"para_10"},{"text":"composed of A. Arabadjiev, President of the Chamber, T. von Danwitz, P.G. Xuereb, A. Kumin (Rapporteur) and I. Ziemele, Judges,","paragraph_id":"para_11"},{"text":"Advocate General: P. Pikamäe,","paragraph_id":"para_12"},{"text":"Registrar: A. Calot Escobar,","paragraph_id":"para_13"},{"text":"having regard to the written procedure,","paragraph_id":"para_14"},{"text":"after considering the observations submitted on behalf of:","paragraph_id":"para_15"},{"text":"–","paragraph_id":"para_16"},{"text":"TR, by F. Wittmaack, Rechtsanwalt,","paragraph_id":"para_17"},{"text":"–","paragraph_id":"para_18"},{"text":"the Land of Hesse, by M. Kottmann and G. Ziegenhorn, Rechtsanwälte,","paragraph_id":"para_19"},{"text":"–","paragraph_id":"para_20"},{"text":"the Austrian Government, by J. Schmoll and M.-T. Rappersberger, acting as Agents,","paragraph_id":"para_21"},{"text":"–","paragraph_id":"para_22"},{"text":"the Portuguese Government, by P. Barros da Costa, M.J. Ramos and C. Vieira Guerra, acting as Agents,","paragraph_id":"para_23"},{"text":"–","paragraph_id":"para_24"},{"text":"the Romanian Government, by L.-E. Baţagoi and E. Gane, acting as Agents,","paragraph_id":"para_25"},{"text":"–","paragraph_id":"para_26"},{"text":"the Norwegian Government, by S.-E. Jahr Dahl, L.M. Moen Jünge and M. Munthe-Kaas, acting as Agents,","paragraph_id":"para_27"},{"text":"–","paragraph_id":"para_28"},{"text":"the European Commission, by A. Bouchagiar, M. Heller and H. Kranenborg, acting as Agents,","paragraph_id":"para_29"},{"text":"after hearing the Opinion of the Advocate General at the sitting on 11 April 2024,","paragraph_id":"para_30"},{"text":"gives the following","paragraph_id":"para_31"},{"text":"Judgment","paragraph_id":"para_32"},{"text":"1","paragraph_id":"para_33"},{"text":"This request for a preliminary ruling concerns the interpretation of Article 57(1)(a) and (f), Article 58(2) and Article 77(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ( OJ 2016 L 119, p. 1 ; ‘the GDPR’).","paragraph_id":"para_34"},{"text":"2","paragraph_id":"para_35"},{"text":"The request has been made in proceedings between TR and Land Hessen, (Land of Hesse, Germany), concerning the non-exercise by the Hessischer Beauftragte für Datenschutz und Informationsfreiheit (Hessen Commissioner for Data Protection and Freedom of Information, Germany) (‘the HBDI’) of corrective powers in respect of the Sparkasse X (Savings bank X; ‘the savings bank’).","paragraph_id":"para_36"},{"text":"Legal context","paragraph_id":"para_37"},{"text":"3","paragraph_id":"para_38"},{"text":"Under recitals 6, 7, 10, 129 and 148 of the GDPR:","paragraph_id":"para_39"},{"text":"‘(6)","paragraph_id":"para_40"},{"text":"Rapid technological developments and globalisation have brought new challenges for the protection of personal data. The scale of the collection and sharing of personal data has increased significantly. …","paragraph_id":"para_41"},{"text":"(7)","paragraph_id":"para_42"},{"text":"Those developments require a strong and more coherent data protection framework in the [European] Union, backed by strong enforcement, given the importance of creating the trust that will allow the digital economy to develop across the internal market. …","paragraph_id":"para_43"},{"text":"…","paragraph_id":"para_44"},{"text":"(10)","paragraph_id":"para_45"},{"text":"In order to ensure a consistent and high level of protection of natural persons and to remove the obstacles to flows of personal data within the Union, the level of protection of the rights and freedoms of natural persons with regard to the processing of such data should be equivalent in all Member States. …","paragraph_id":"para_46"},{"text":"…","paragraph_id":"para_47"},{"text":"(129)","paragraph_id":"para_48"},{"text":"… The powers of supervisory authorities should be exercised in accordance with appropriate procedural safeguards set out in Union and Member State law, impartially, fairly and within a reasonable time. In particular each measure should be appropriate, necessary and proportionate in view of ensuring …","paragraph_id":"para_49"},{"text":"…","paragraph_id":"para_50"},{"text":"(148)","paragraph_id":"para_51"},{"text":"In order to strengthen the enforcement of the rules of this Regulation, penalties including administrative fines should be imposed for any infringement of this Regulation, in addition to, or instead of appropriate measures imposed by the supervisory authority pursuant to this Regulation. In a case o …","paragraph_id":"para_52"},{"text":"4","paragraph_id":"para_53"},{"text":"Article 5 of that regulation reads as follows:","paragraph_id":"para_54"},{"text":"‘1.   Personal data shall be:","paragraph_id":"para_55"},{"text":"(a)","paragraph_id":"para_56"},{"text":"processed lawfully, fairly and in a transparent manner in relation to the data subject (“lawfulness, fairness and transparency”);","paragraph_id":"para_57"},{"text":"(b)","paragraph_id":"para_58"},{"text":"collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes … the (“purpose limitation”);","paragraph_id":"para_59"},{"text":"(c)","paragraph_id":"para_60"},{"text":"adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);","paragraph_id":"para_61"},{"text":"(d)","paragraph_id":"para_62"},{"text":"accurate and, where necessary, kept up to date … (“accuracy”);","paragraph_id":"para_63"},{"text":"(e)","paragraph_id":"para_64"},{"text":"kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed … (“storage limitation”);","paragraph_id":"para_65"},{"text":"(f)","paragraph_id":"para_66"},{"text":"processed in a manner that ensures appropriate security of the personal data … (“integrity and confidentiality”).","paragraph_id":"para_67"},{"text":"2.   The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (“accountability”).’","paragraph_id":"para_68"},{"text":"5","paragraph_id":"para_69"},{"text":"Article 24(1) of that regulation provides:","paragraph_id":"para_70"},{"text":"‘Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.’","paragraph_id":"para_71"},{"text":"6","paragraph_id":"para_72"},{"text":"Article 33 of that regulation provides:","paragraph_id":"para_73"},{"text":"‘1.   In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. …","paragraph_id":"para_74"},{"text":"…","paragraph_id":"para_75"},{"text":"3.   The notification referred to in paragraph 1 shall at least:","paragraph_id":"para_76"},{"text":"(a)","paragraph_id":"para_77"},{"text":"describe the nature of the personal data breach including where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;","paragraph_id":"para_78"},{"text":"(b)","paragraph_id":"para_79"},{"text":"communicate the name and contact details of the data protection officer or other contact point where more information can be obtained;","paragraph_id":"para_80"},{"text":"(c)","paragraph_id":"para_81"},{"text":"describe the likely consequences of the personal data breach;","paragraph_id":"para_82"},{"text":"(d)","paragraph_id":"para_83"},{"text":"describe the measures taken or proposed to be taken by the controller to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.","paragraph_id":"para_84"},{"text":"…’","paragraph_id":"para_85"},{"text":"7","paragraph_id":"para_86"},{"text":"Article 34(1) of the GDPR states:","paragraph_id":"para_87"},{"text":"‘When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.’","paragraph_id":"para_88"},{"text":"8","paragraph_id":"para_89"},{"text":"Chapter VI of that regulation, entitled ‘Independent supervisory authorities’, includes Articles 51 to 59 thereof.","paragraph_id":"para_90"},{"text":"9","paragraph_id":"para_91"},{"text":"Article 51(1) of that regulation is worded as follows:","paragraph_id":"para_92"},{"text":"‘Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (“supervisory authority”).’","paragraph_id":"para_93"},{"text":"10","paragraph_id":"para_94"},{"text":"Article 57 of the GDPR, entitled ‘Tasks’, provides, in paragraph 1 thereof:","paragraph_id":"para_95"},{"text":"‘Without prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:","paragraph_id":"para_96"},{"text":"(a)","paragraph_id":"para_97"},{"text":"monitor and enforce the application of this Regulation;","paragraph_id":"para_98"},{"text":"…","paragraph_id":"para_99"},{"text":"(f)","paragraph_id":"para_100"},{"text":"handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80, and investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the progress and the outcome of the investigation within a reasonable period, in particular if further investigation or coordination with another supervisory authority is necessary;","paragraph_id":"para_101"},{"text":"…’","paragraph_id":"para_102"},{"text":"11","paragraph_id":"para_103"},{"text":"Article 58 of that regulation, entitled ‘Powers’, provides, in paragraphs 1 and 2 thereof:","paragraph_id":"para_104"},{"text":"‘1.   Each supervisory authority shall have all of the following investigative powers:","paragraph_id":"para_105"},{"text":"(a)","paragraph_id":"para_106"},{"text":"to order the controller and the processor, and, where applicable, the controller’s or the processor’s representative to provide any information it requires for the performance of its tasks;","paragraph_id":"para_107"},{"text":"…","paragraph_id":"para_108"},{"text":"2.   Each supervisory authority shall have all of the following corrective powers:","paragraph_id":"para_109"},{"text":"(a)","paragraph_id":"para_110"},{"text":"to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;","paragraph_id":"para_111"},{"text":"(b)","paragraph_id":"para_112"},{"text":"to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;","paragraph_id":"para_113"},{"text":"(c)","paragraph_id":"para_114"},{"text":"to order the controller or the processor to comply with the data subject’s requests to exercise his or her rights pursuant to this Regulation;","paragraph_id":"para_115"},{"text":"(d)","paragraph_id":"para_116"},{"text":"to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;","paragraph_id":"para_117"},{"text":"(e)","paragraph_id":"para_118"},{"text":"to order the controller to communicate a personal data breach to the data subject;","paragraph_id":"para_119"},{"text":"(f)","paragraph_id":"para_120"},{"text":"to impose a temporary or definitive limitation including a ban on processing;","paragraph_id":"para_121"},{"text":"…","paragraph_id":"para_122"},{"text":"(i)","paragraph_id":"para_123"},{"text":"to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;","paragraph_id":"para_124"},{"text":"…’","paragraph_id":"para_125"},{"text":"12","paragraph_id":"para_126"},{"text":"Article 77 of that regulation reads as follows:","paragraph_id":"para_127"},{"text":"‘1.   Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation.","paragraph_id":"para_128"},{"text":"2.   The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78.’","paragraph_id":"para_129"},{"text":"13","paragraph_id":"para_130"},{"text":"Article 83(1) and (2) of that regulation provides:","paragraph_id":"para_131"},{"text":"‘1.   Each supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in respect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective, proportionate and dissuasive.","paragraph_id":"para_132"},{"text":"2.   Administrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or instead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an administrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be given to the following:","paragraph_id":"para_133"},{"text":"(a)","paragraph_id":"para_134"},{"text":"the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the processing concerned as well as the number of data subjects affected and the level of damage suffered by them;","paragraph_id":"para_135"},{"text":"(b)","paragraph_id":"para_136"},{"text":"the intentional or negligent character of the infringement;","paragraph_id":"para_137"},{"text":"(c)","paragraph_id":"para_138"},{"text":"any action taken by the controller or processor to mitigate the damage suffered by data subjects;","paragraph_id":"para_139"},{"text":"(d)","paragraph_id":"para_140"},{"text":"the degree of responsibility of the controller or processor taking into account technical and organisational measures implemented by them pursuant to Articles 25 and 32;","paragraph_id":"para_141"},{"text":"(e)","paragraph_id":"para_142"},{"text":"any relevant previous infringements by the controller or processor;","paragraph_id":"para_143"},{"text":"(f)","paragraph_id":"para_144"},{"text":"the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the possible adverse effects of the infringement;","paragraph_id":"para_145"},{"text":"(g)","paragraph_id":"para_146"},{"text":"the categories of personal data affected by the infringement;","paragraph_id":"para_147"},{"text":"(h)","paragraph_id":"para_148"},{"text":"the manner in which the infringement became known to the supervisory authority, in particular whether, and if so to what extent, the controller or processor notified the infringement;","paragraph_id":"para_149"},{"text":"(i)","paragraph_id":"para_150"},{"text":"where measures referred to in Article 58(2) have previously been ordered against the controller or processor concerned with regard to the same subject-matter, compliance with those measures;","paragraph_id":"para_151"},{"text":"(j)","paragraph_id":"para_152"},{"text":"adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; and","paragraph_id":"para_153"},{"text":"(k)","paragraph_id":"para_154"},{"text":"any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits gained, or losses avoided, directly or indirectly, from the infringement.’","paragraph_id":"para_155"},{"text":"The dispute in the main proceedings and the question referred for a preliminary ruling","paragraph_id":"para_156"},{"text":"14","paragraph_id":"para_157"},{"text":"The savings bank is a communal institution governed by public law, whose tasks include the settlement of banking and credit transactions. On 15 November 2019, it notified the HBDI, in accordance with Article 33 of the GDPR, of a personal data breach consisting of the fact that one of its employees had, on several occasions, unlawfully accessed personal data of TR, one of its customers. The savings bank failed to notify TR of the breach of his personal data.","paragraph_id":"para_158"},{"text":"15","paragraph_id":"para_159"},{"text":"After incidentally becoming aware that his personal data had been improperly consulted, TR lodged a complaint with the HBDI on 27 July 2020 on the basis of Article 77 of the GDPR. In that complaint, he complained that the breach of his personal data had not been communicated to him, in breach of Art …","paragraph_id":"para_160"},{"text":"16","paragraph_id":"para_161"},{"text":"Following the complaint lodged by TR, the HBDI heard the savings bank in writing and orally on the criticisms made against it. During the hearing, the savings bank stated that it had refrained from making a communication under Article 34 of the GDPR because its data protection officer had taken the …","paragraph_id":"para_162"},{"text":"17","paragraph_id":"para_163"},{"text":"By decision of 3 September 2020, the HBDI informed TR that the savings bank had not infringed Article 34 of the GDPR, since the savings bank’s assessment that the personal data breach committed was unlikely to result in a high risk to his rights and freedoms, within the meaning of that article, was …","paragraph_id":"para_164"},{"text":"18","paragraph_id":"para_165"},{"text":"TR lodged an action against that decision before the Verwaltungsgericht Wiesbaden (Administrative Court, Wiesbaden, Germany), the referring court, asking it to order the HBDI to take action against the savings bank.","paragraph_id":"para_166"},{"text":"19","paragraph_id":"para_167"},{"text":"In support of his action, TR submits that the HBDI failed to handle his complaint in accordance with the requirements of the GDPR, that is to say, by having regard to all the factual circumstances, and adds that the HBDI should have imposed a fine on the savings bank in view of the latter’s various …","paragraph_id":"para_168"},{"text":"20","paragraph_id":"para_169"},{"text":"In that regard, the referring court asks, in essence, whether, where a breach of provisions relating to the protection of personal data is established, the GDPR must be interpreted as meaning that the supervisory authority is required to exercise corrective powers under Article 58(2) of that regulat …","paragraph_id":"para_170"},{"text":"21","paragraph_id":"para_171"},{"text":"The referring court states that the first interpretation, which is that advocated by TR and by some academic writers, is based on the fact that the powers available to a supervisory authority to adopt corrective measures are intended to restore a lawful situation when data processing infringes a cit …","paragraph_id":"para_172"},{"text":"22","paragraph_id":"para_173"},{"text":"The referring court doubts, however, whether that interpretation, which it considers to be too broad, is well founded and is inclined instead to allow the supervisory authority a discretion authorising it, in certain cases, to refrain from exercising a corrective power, in particular the power to im …","paragraph_id":"para_174"},{"text":"23","paragraph_id":"para_175"},{"text":"In those circumstances, the Verwaltungsgericht Wiesbaden (Administrative Court, Wiesbaden) decided to stay the proceedings and to refer the following question to the Court of Justice for a preliminary ruling:","paragraph_id":"para_176"},{"text":"‘Are Article 57(1)(a) and (f), Article 58(2)(a) to (j) and Article 77(1) [of the GDPR], to be understood as meaning that, where the supervisory authority finds that data processing has infringed the data subject’s rights, the supervisory authority must always take action in accordance with Article 58(2) [of that regulation]?’","paragraph_id":"para_177"},{"text":"Admissibility of the request for a preliminary ruling","paragraph_id":"para_178"},{"text":"24","paragraph_id":"para_179"},{"text":"Without expressly challenging the admissibility of the request for a preliminary ruling, TR submits that an answer to the question referred is not necessary in order to resolve the dispute in the main proceedings. He argues that his action merely asks the referring court to order the HBDI to rule on …","paragraph_id":"para_180"},{"text":"25","paragraph_id":"para_181"},{"text":"In that regard, it must be noted that, in the context of the cooperation between the Court and the national courts established in Article 267 TFEU, it is for the national court before which a dispute has been brought, and which must assume responsibility for the subsequent judicial decision, alone t …","paragraph_id":"para_182"},{"text":"26","paragraph_id":"para_183"},{"text":"It follows that questions on the interpretation of EU law referred by a national court in the factual and legislative context which that court is responsible for defining, the accuracy of which is not a matter for the Court to determine, enjoy a presumption of relevance. The Court may refuse to rule …","paragraph_id":"para_184"},{"text":"27","paragraph_id":"para_185"},{"text":"In the present case, the referring court observes that TR has claimed that he has a right for the HBDI to intervene and has asserted that it was required to impose a fine on the savings bank.","paragraph_id":"para_186"},{"text":"28","paragraph_id":"para_187"},{"text":"Therefore, it is not obvious that the interpretation of EU law that is sought bears no relation to the actual facts of the main action or its purpose.","paragraph_id":"para_188"},{"text":"29","paragraph_id":"para_189"},{"text":"Accordingly, the request for a preliminary ruling is admissible.","paragraph_id":"para_190"},{"text":"Consideration of the question referred","paragraph_id":"para_191"},{"text":"30","paragraph_id":"para_192"},{"text":"In order to answer the question referred, it should be borne in mind, as a preliminary point, that the interpretation of a provision of EU law requires that account be taken not only of its wording, but also of its context and the objectives and purpose pursued by the act of which it forms part (judgment of 7 December 2023, SCHUFA Holding (Discharge from remaining debts), C‑26/22 and C‑64/22 , EU:C:2023:958 , paragraph  48 and the case-law cited).","paragraph_id":"para_193"},{"text":"31","paragraph_id":"para_194"},{"text":"It should also be borne in mind that, in accordance with Article 8(3) of the Charter of Fundamental Rights of the European Union and Article 51(1) and Article 57(1)(a) of the GDPR, the national supervisory authorities are responsible for monitoring compliance with the EU rules concerning the protect …","paragraph_id":"para_195"},{"text":"32","paragraph_id":"para_196"},{"text":"In particular, under Article 57(1)(f) of the GDPR, each supervisory authority is required on its territory to handle complaints which, in accordance with Article 77(1) of that regulation, any data subject is entitled to lodge where that data subject considers that the processing of personal data rel …","paragraph_id":"para_197"},{"text":"33","paragraph_id":"para_198"},{"text":"In order to handle complaints thus lodged, Article 58(1) of the GDPR confers extensive investigative powers on each supervisory authority. Where, following its investigation, such an authority finds an infringement of the provisions of that regulation, it is required to react appropriately in order …","paragraph_id":"para_199"},{"text":"34","paragraph_id":"para_200"},{"text":"Thus, under Article 58(2) of the GDPR, the supervisory authority has the power, inter alia, to issue reprimands to a controller or a processor where processing operations have infringed provisions of that regulation (point (b)), to order the controller or the processor to comply with the data subjec …","paragraph_id":"para_201"},{"text":"35","paragraph_id":"para_202"},{"text":"Therefore, the complaints procedure is designed as a mechanism capable of effectively safeguarding the rights and interests of data subjects (judgment of 7 December 2023, SCHUFA Holding (Discharge from remaining debts), C‑26/22 and C‑64/22 , EU:C:2023:958 , paragraph  58 ).","paragraph_id":"para_203"},{"text":"36","paragraph_id":"para_204"},{"text":"In the present case, it is apparent from the request for a preliminary ruling that the HBDI examined the substance of the complaint which had been brought before it by the applicant in the main proceedings and informed him of the outcome of the investigation. More specifically, the HBDI confirmed th …","paragraph_id":"para_205"},{"text":"37","paragraph_id":"para_206"},{"text":"In that regard, it should be noted that the GDPR leaves the supervisory authority a discretion as to the manner in which it must remedy the shortcoming found, since Article 58(2) thereof confers on that authority the power to adopt various corrective measures. Thus, the Court has already held that t …","paragraph_id":"para_207"},{"text":"38","paragraph_id":"para_208"},{"text":"That discretion is, however, limited by the need to ensure a consistent and high level of protection of personal data through strong enforcement of the rules, as is apparent from recitals 7 and 10 of the GDPR.","paragraph_id":"para_209"},{"text":"39","paragraph_id":"para_210"},{"text":"As regards, more specifically, the administrative fines referred to in Article 58(2)(i) of the GDPR, it is apparent from Article 83(2) of that regulation that they are imposed, depending on the circumstances of each individual case, in addition to, or instead of, the other measures referred to in Ar …","paragraph_id":"para_211"},{"text":"40","paragraph_id":"para_212"},{"text":"Thus, the system of sanctions provided for by the EU legislature allows supervisory authorities to impose the most appropriate and justified penalties depending on the circumstances of each individual case (see, to that effect, judgment of 5 December 2023, Nacionalinis visuomenės sveikatos centras, …","paragraph_id":"para_213"},{"text":"41","paragraph_id":"para_214"},{"text":"Therefore, it cannot be inferred either from Article 58(2) of the GDPR or from Article 83 thereof that the supervisory authority is under an obligation to exercise, in all cases where it finds a breach of personal data, a corrective power, in particular the power to impose an administrative fine, it …","paragraph_id":"para_215"},{"text":"42","paragraph_id":"para_216"},{"text":"By contrast, the supervisory authority is required to take action where the exercise of one or more of the corrective powers provided for in Article 58(2) of the GDPR is, taking into account all the circumstances of the specific case, appropriate, necessary and proportionate to remedy the shortcoming found and ensure that that regulation is fully enforced.","paragraph_id":"para_217"},{"text":"43","paragraph_id":"para_218"},{"text":"In that regard, it cannot be ruled out that, exceptionally and in the light of the particular circumstances of the specific case, the supervisory authority may refrain from exercising a corrective power even though a breach of personal data has been established. That could be the case, inter alia, w …","paragraph_id":"para_219"},{"text":"44","paragraph_id":"para_220"},{"text":"The interpretation according to which the supervisory authority, when it finds that there has been a breach of personal data, is not required to exercise in all cases a corrective power under Article 58(2) of the GDPR is supported by the objectives pursued respectively by Article 58(2) and Article 83 of that regulation.","paragraph_id":"para_221"},{"text":"45","paragraph_id":"para_222"},{"text":"As regards the objective pursued by Article 58(2) of the GDPR, it is apparent from recital 129 thereof that that provision seeks to ensure that the processing of personal data complies with that regulation and to make good situations where there has been a breach of that regulation so as to make the …","paragraph_id":"para_223"},{"text":"46","paragraph_id":"para_224"},{"text":"It follows that the exercise of a corrective power may, exceptionally and in the light of the particular circumstances of the specific case, not be required, provided that the situation in which the GDPR was infringed has already been made good and that the processing of personal data by the control …","paragraph_id":"para_225"},{"text":"47","paragraph_id":"para_226"},{"text":"As regards the objective pursued by Article 83 of the GDPR, relating to the imposition of administrative fines, that objective is, according to recital 148 of that regulation, to strengthen the enforcement of the rules of that regulation. However, that recital states that, in a case of a minor infri …","paragraph_id":"para_227"},{"text":"48","paragraph_id":"para_228"},{"text":"In the present case, it is apparent from the request for a preliminary ruling that the savings bank notified the HBDI, in accordance with Article 33 of the GDPR, of the breach of the personal data of the applicant in the main proceedings, resulting from the unauthorised access to those data by one o …","paragraph_id":"para_229"},{"text":"49","paragraph_id":"para_230"},{"text":"Since decisions on complaints adopted by a supervisory authority are subject to full judicial review (judgment of 7 December 2023, SCHUFA Holding (Discharge from remaining debts), C‑26/22 and C‑64/22 , EU:C:2023:958 , paragraph  70 ), it is for the referring court to ascertain whether the HBDI dealt …","paragraph_id":"para_231"},{"text":"50","paragraph_id":"para_232"},{"text":"In the light of all the foregoing considerations, the answer to the question referred is that Article 57(1)(a) and (f), Article 58(2) and Article 77(1) of the GDPR must be interpreted as meaning that, when a breach of personal data has been established, the supervisory authority is not required to e …","paragraph_id":"para_233"},{"text":"Costs","paragraph_id":"para_234"},{"text":"51","paragraph_id":"para_235"},{"text":"Since these proceedings are, for the parties to the main proceedings, a step in the action pending before the referring court, the decision on costs is a matter for that court. Costs incurred in submitting observations to the Court, other than the costs of those parties, are not recoverable.","paragraph_id":"para_236"},{"text":"On those grounds, the Court (First Chamber) hereby rules:","paragraph_id":"para_237"},{"text":"Article 57(1)(a) and (f), Article 58(2) and Article 77(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),","paragraph_id":"para_238"},{"text":"must be interpreted as meaning that when a breach of personal data has been established, the supervisory authority is not required to exercise a corrective power, in particular the power to impose an administrative fine, under that Article 58(2) where such action is not appropriate, necessary or proportionate to remedy the shortcoming found and to ensure that that regulation is fully enforced.","paragraph_id":"para_239"},{"text":"[Signatures]","paragraph_id":"para_240"},{"text":"(\n *1\n ) Language of the case: German.","paragraph_id":"para_241"}],"word_count":5813,"cites":["C-270/22","C-26/22","C-64/22","C-311/18","C-683/21","C-46/23"],"sha256":"d0f0a8fa9b8d954b619a921474152090a9b01df2bba16da0fb10b3e242119293","source_url":"https://publications.europa.eu/resource/celex/62021CJ0768.ENG.xhtml.ECR_62021CJ0768_EN_01.html","fetched_at":"2026-10-02T05:46:00.565+00:00","canonical":"https://legal.exploreworldai.com/ai/judgments/eu/c-768-21","risk_graph":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-768-21","relations_graph":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-768-21","changes":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/changes","agent":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-768-21","verification":{"stored_sha256":"d0f0a8fa9b8d954b619a921474152090a9b01df2bba16da0fb10b3e242119293","recomputed_sha256":"d0f0a8fa9b8d954b619a921474152090a9b01df2bba16da0fb10b3e242119293","intact":true,"checked_at":"2026-10-20T06:27:45.341Z"}},"hash":"sha256:0b4c67dfbc7299582edd6147c6c9af28f213f9c162e81e9a1dde0e955fefaca8","version":"legal-2026-10-20","expires":"2026-10-21T00:00:00.000Z","dependency":{"index_version":"legal-2026-10-20+legal-2026-10-20+2026-10-20T03:54:38","content_hash":"sha256:0b4c67dfbc7299582edd6147c6c9af28f213f9c162e81e9a1dde0e955fefaca8","revalidate_after":"2026-10-20T07:27:45.798Z","max_copy_age_seconds":3600,"policy":"revalidate-required; attribution-preferred","changelog":"https://legal.exploreworldai.com/api/public/v1/dependency","verify":"https://legal.exploreworldai.com/api/public/v1/verify","stale_copy_invalid":true},"canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-768-21","follow":[{"rel":"risk","href":"https://legal.exploreworldai.com/api/public/v1/risk?id=eu:c-768-21"},{"rel":"relations","href":"https://legal.exploreworldai.com/api/public/v1/relations?id=eu:c-768-21"},{"rel":"agent","href":"https://legal.exploreworldai.com/api/public/v1/eu-praxis/agent?id=eu:c-768-21"},{"rel":"obligations","href":"https://legal.exploreworldai.com/api/public/v1/obligation-chain"},{"rel":"changes","href":"https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu"}],"disclaimer":"Source reference with official identifier. Not legal advice and not a compliance decision.","content_notice":{"legal_advice":false,"nature":"Source register. Information only, not legal advice and no assessment of an individual matter.","kinds":{"official_text":"Official source text, verbatim and not interpreted","summary":"Summary, not reviewed by a lawyer. Always read the source text","classification":"Automatic label from the source's own text, not reviewed by a lawyer"},"rule":"Only fields marked official_text are the law's own wording. Everything else points to it.","report_error":"https://legal.exploreworldai.com/api/public/v1/corrections","ai_act_declaration":"https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"},"usageInfo":"https://legal.exploreworldai.com/citering","_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/judgment-text","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"item.cited_by":2},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"public","access_view":"public","citation":{"citation_url":"https://legal.exploreworldai.com/eu/praxis/c-768-21","cite_as":"NovaCopilot (legal.exploreworldai.com)","provenance":{"publisher":"NovaCopilot","signature":"nc-adb35e6bc4b78e23a035cdf9d5595399","response_hash":"sha256:0b4c67dfbc7299582edd6147c6c9af28f213f9c162e81e9a1dde0e955fefaca8"}},"freshness":{"freshness_class":"live","as_of":"2026-11-03T08:57:36.414Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu%3Ac-768-21&verify=1","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":14860}}