DATA PROTECTION | ECJ on fine to be imposed by supervisory authorities in cases of data breach

On 26 September 2024, the European Court of Justice (ECJ) issued its judgment in case C-768/21 (TR v. Land Hessen) finding that when a personal data breach has been identified, the supervisory authority is not required to exercise corrective power, in particular the power to impose an administrative fine, where such action is not necessary to address the breach and ensure full compliance with the GDPR. This may be the case, for example, when the data controller, upon becoming aware of a breach, has already taken prompt measures necessary to stop said breach and prevent its recurrence.

Newsletter n. 100 – October 2024