# C_2023205EN.01002901.xml

| 12.6.2023 | EN | Official Journal of the European Union | C 205/29 |
| --- | --- | --- | --- |

12.6.2023

EN

Official Journal of the European Union

C 205/29

---

Request for a preliminary ruling from the Kúria (Hungary) lodged on 17 March 2023 — Nemzeti Adatvédelmi és Információszabadság Hatóság v UC

(Case C-169/23, Másdi (1))

(2023/C 205/33)

Language of the case: Hungarian

Referring court

Kúria

Parties to the main proceedings

Appellant and defendant at first instance: Nemzeti Adatvédelmi és Információszabadság Hatóság

Respondent and applicant at first instance: UC

Questions referred

| (1) | Must Article 14(5)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (2) (‘the GDPR’), read in conjunction with Article 14(1) and recital 62 thereof, be interpreted as meaning that the exception laid down in Article 14(5)(c) does not refer to data generated by the controller in its own procedure but rather only to data which the controller has expressly obtained from another person? |
| --- | --- |

(1)

Must Article 14(5)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (2) (‘the GDPR’), read in conjunction with Article 14(1) and recital 62 thereof, be interpreted as meaning that the exception laid down in Article 14(5)(c) does not refer to data generated by the controller in its own procedure but rather only to data which the controller has expressly obtained from another person?

| (2) | If Article 14(5)(c) of the GDPR is also applicable to data generated by the controller in its own procedure, must the right to lodge a complaint with a supervisory authority, laid down in Article 77(1) of the GDPR, be interpreted as meaning that a natural person who alleges an infringement of the obligation to provide information is entitled, when exercising his or her right to lodge a complaint, to request an examination of whether Member State law provides appropriate measures to protect the data subject’s legitimate interests, in accordance with Article 14(5)(c) of the GDPR? |
| --- | --- |

(2)

If Article 14(5)(c) of the GDPR is also applicable to data generated by the controller in its own procedure, must the right to lodge a complaint with a supervisory authority, laid down in Article 77(1) of the GDPR, be interpreted as meaning that a natural person who alleges an infringement of the obligation to provide information is entitled, when exercising his or her right to lodge a complaint, to request an examination of whether Member State law provides appropriate measures to protect the data subject’s legitimate interests, in accordance with Article 14(5)(c) of the GDPR?

| (3) | If the answer to the second question is in the affirmative, may Article 14(5)(c) of the GDPR be interpreted as meaning that the ‘appropriate measures’ referred to in that provision require the national legislature to transpose (by means of legislation) the measures relating to the security of data laid down in Article 32 of the GDPR? |
| --- | --- |

(3)

If the answer to the second question is in the affirmative, may Article 14(5)(c) of the GDPR be interpreted as meaning that the ‘appropriate measures’ referred to in that provision require the national legislature to transpose (by means of legislation) the measures relating to the security of data laid down in Article 32 of the GDPR?

---

(1)  The name of the present case is a fictitious name. It does not correspond to the real name of any party to the proceedings.

(2)  OJ 2016 L 119, p. 1.

---