Judgment — ECLI:EU:C:2024:988
Date: 2024-11-28
Language of the case: Hungarian
Court formation: Third Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Hungary

Anonymised version 
Translation C-169/23 – 1 
Case C-169/23 
Request for a preliminary ruling 
Date lodged: 
17 March 2023 
Referring court: 
Kúria (Hungary) 
Date of the decision to refer: 
8 February 2023 
Appellant and defendant at first instance (‘defendant’): 
Nemzeti Adatvédelmi és Információszabadság Hatóság 
Respondent and applicant at first instance (‘applicant’): 
UC 
  
Order 
of the Kúria (Supreme Court, Hungary) 
sitting as a court of cassation 
[…] 
Applicant: UC 
([…] Budapest, Hungary) 
[…] 
Defendant: Nemzeti Adatvédelmi és Információszabadság Hatóság (National 
Authority for Data Protection and Freedom of Information, Hungary) 
([…] Budapest, Hungary) 
EN 
REQUEST FOR A PRELIMINARY RULING OF 8. 2. 2023 – CASE C-169/23 
 
2  
Anonymised version 
[…] 
Subject matter of the proceedings: case relating to data protection 
Appellant: the defendant 
[…] 
Operative part 
The Kúria (Supreme Court) refers the following questions to the Court of Justice 
of the European Union for a preliminary ruling: 
(1) Must Article 14(5)(c) of Regulation (EU) 2016/679 of the European 
Parliament and of the Council of 27 April 2016 on the protection of natural 
persons with regard to the processing of personal data and on the free movement 
of such data, and repealing Directive 95/46/EC (General Data Protection 
Regulation) (‘the GDPR’), read in conjunction with Article 14(1) and recital 62 
thereof, be interpreted as meaning that the exception laid down in Article 14(5)(c) 
does not refer to data generated by the controller in its own procedure but rather 
only to data which the controller has expressly obtained from another person? 
(2) If Article 14(5)(c) of the GDPR is also applicable to data generated by the 
controller in its own procedure, must the right to lodge a complaint with a 
supervisory authority, laid down in Article 77(1) of the GDPR, be interpreted as 
meaning that a natural person who alleges an infringement of the obligation to 
provide information is entitled, when exercising his or her right to lodge a 
complaint, to request an examination of whether Member State law provides 
appropriate measures to protect the data subject’s legitimate interests, in 
accordance with Article 14(5)(c) of the GDPR? 
(3) If the answer to the second question is in the affirmative, may 
Article 14(5)(c) of the GDPR be interpreted as meaning that the ‘appropriate 
measures’ referred to in that provision require the national legislature to transpose 
(by means of legislation) the measures relating to the security of data laid down in 
Article 32 of the GDPR? 
[…] [aspects of national procedural law] 
Reasoning 
1 The Kúria (Supreme Court), in its capacity as a court against whose decisions 
there is no judicial remedy, requests the Court of Justice of the European Union 
(‘the Court of Justice’), under Article 267 TFEU, to interpret the provisions of 
European Union law which are necessary for the resolution of the case. 
MÁSDI 
 
3 
Anonymised version 
Subject matter of the dispute and facts relevant to the request for a 
preliminary ruling 
2 In Hungary, a certificate of immunity to coronavirus was issued, on the basis of a 
legal authorisation, by the Budapest Főváros Kormányhivatala (Budapest 
Metropolitan Government Office, Hungary; ‘the issuing authority’), which is not a 
party to the present proceedings. After receiving from the issuing authority a 
certificate of immunity confirming that he had been vaccinated against the 
COVID-19 virus, the applicant, a natural person, then lodged a complaint, on 
30 April 2021, with the Nemzeti Adatvédelmi és Információszabadság Hatóság 
(National Authority for Data Protection and Freedom of Information, Hungary; 
‘the defendant’), asking it to conduct an administrative procedure in relation to 
data protection leading to an order that the issuing authority bring its processing 
operations in line with the provisions of the GDPR. In his complaint, the applicant 
claimed, inter alia, that the issuing authority had not created or published an 
information leaflet on the processing of data relating to the issue of immunity 
certificates and that there was insufficient information concerning the purpose and 
legal basis of the processing, the rights available to data subjects and how those 
rights could be exercised. 
3 In the procedure initiated as a result of the complaint thus lodged, the issuing 
authority declared, at the request of the defendant, that it performed its duties 
relating to the issuance of immunity certificates pursuant to Article 2 of the a 
koronavírus elleni védettségi igazolásról szóló 60/2021. (II.12.) Korm. rendelet 
(Government Decree 60/2021 of 12 February on the certificate of immunity to 
coronavirus; ‘the Government Decree’), and that the legal basis for the processing 
was Article 6(1)(e) of the GDPR and, as regards the processing of special 
categories of personal data, Article 9([2])(i) of the GDPR. It stated that, in 
accordance with Article 3(2) and (3) of the Government Decree, it had collected 
the data processed by the automated transmission of information from the 
electronic service space operator and from the body responsible for the recording 
of personal data and addresses. It stated that, pursuant to Article 14(5)(c) of the 
GDPR, it was not required to provide information on processing but that, even so, 
it had created an information leaflet on processing and had published that leaflet 
on its website. 
4 By decision of 15 November 2021 […], the defendant dismissed the applicant’s 
complaint. The statement of grounds for the decision indicated that the issuing 
authority did not have an obligation to provide information under Article 14 of the 
GDPR, since the exception laid down in Article 14(5)(c) of the GDPR was 
applicable to the processing. The Government Decree constituted the legal basis 
for the processing under examination and, in view of the fact that the issuing 
authority did not obtain the data from the data subjects themselves and, also, that 
Article 3(1) of the Government Decree expressly directed the issuing authority to 
collect the data, that authority was not required to provide information, pursuant to 
Article 14(5)(c) of the GDPR. According to the grounds of the decision, it was 
deemed to be good practice that the issuing authority had published information 
REQUEST FOR A PRELIMINARY RULING OF 8. 2. 2023 – CASE C-169/23 
 
4  
Anonymised version 
on the processing of data on its website, even though it did not have a legal 
obligation to do so. 
5 The defendant examined ex officio the subject of appropriate measures to protect 
the data subject’s legitimate interests, referred to in the second half-sentence of 
Article 14(5)(c) of the GDPR, and declared that Articles 5 to 7 and Articles 2 and 
3 of the Government Decree should be treated as such measures. 
6 It was noted in the grounds of the decision that, for the purposes of assessing 
whether the exception was applicable, paragraph 66 of Guidelines WP 260 [of the 
Article 29 Data Protection Working Party] and paragraph 41 of Guidelines 
03/2020 of the [European Data Protection Board] had been taken into 
consideration. 
7 According to those grounds, the issuing authority was not required to provide 
information either, because it was aware ex officio of the applicant’s academic 
qualifications and professional expertise and knew, therefore, that the applicant 
had not sustained any infringement of his rights. 
8 It was also apparent from that statement of grounds that, in accordance with 
Article 77(1) of the GDPR, the applicant was entitled only to lodge a complaint 
seeking compensation for the infringement of rights pertaining to him, and 
therefore the [defendant] did not rule on the applicant’s claim relating to the 
provision of the information leaflet on processing to other data subjects and the 
imposition of a fine in the event of non-compliance. The defendant stated that, 
even so, it had examined ex officio the provisions of the Government Decree, 
including the second half-sentence of Article 14(5)(c) of the GDPR. 
9 The applicant lodged an administrative-law action against that decision. The 
Fővárosi Törvényszék (Budapest High Court, Hungary) [‘the administrative 
court’] upheld the action, annulling the defendant’s decision and ordering the 
defendant to conduct a new procedure. 
10 In the reasoning of its judgment, the administrative court stated, in connection 
with the interpretation of Article 14(5)(c) of the GDPR, that the exception was not 
applicable because, in connection with the immunity certificates, data are 
generated which the controller does not collect from another body and instead 
generates itself. Those data include the serial number of the immunity certificate 
(card), the period of validity of the certificate where the holder has had the 
disease, the QR code incorporated into the card, the bar code and other 
alphanumerical codes which feature on the delivery receipt, and data generated by 
the controller during its procedure in relation to the handling of the case. 
11 In accordance with the administrative court’s interpretation, the exception laid 
down in Article 14(5)(c) of the GDPR may refer only to data collected from 
another body. 
MÁSDI 
 
5 
Anonymised version 
12 According to the reasoning in that judgment, the [contested] decision was 
manifestly unreasonable when it held that the exception laid down in 
Article 14(5)(a) of the GDPR was applicable because that exception may only 
apply where the information provided has previously covered each and every 
aspect of the data processing and there has been no alteration in the meantime of 
the circumstances of the processing, while the data subject’s professional 
qualifications or training are not relevant for the purposes of that assessment. 
13 It is also apparent from that reasoning that the administrative appeal brought by 
the applicant before the defendant was not directed at the exercise of the power 
referred to in Article 58(2)(c) of the GDPR and that instead it was a complaint 
lodged pursuant to Article 77(1) of the GDPR; that provision does not make the 
right to make a complaint to the [supervisory] authority conditional on the 
requirement that the applicant must previously have made a complaint to the 
issuing authority. The reasoning also states that, in the procedure conducted 
against the defendant, the latter had urged the issuing authority to make a general 
statement with regard to all data subjects and not specifically with regard to the 
applicant. 
14 The judgment of the administrative court did not examine the second half-
sentence of Article 14(5)(c) of the GDPR, in view of the administrative court’s 
interpretation of that exception. 
15 The defendant brought an extraordinary appeal in cassation against that final 
judgment, as a result of which the Kúria (Supreme Court) initiated the present 
cassation proceedings. 
16 According to the defendant’s appeal in cassation, the judgment of the 
administrative court is unlawful because, inter alia, it incorrectly and unlawfully 
interprets Article 14(1) and (5)(c) of the GDPR. 
17 In its response to the appeal in cassation, the applicant requests, principally, that 
the judgment of the administrative court be confirmed, arguing that it was given 
lawfully, and, in the alternative, if the Kúria (Supreme Court) does not share that 
point of view, it requests that preliminary ruling proceedings be initiated before 
the Court of Justice so that the latter may interpret Article 14(1) of the GDPR and 
the exception laid down in Article 14(5)(c) of the GDPR. 
Applicable legislation 
(A) European Union law: 
18 Article 14(1) of the GDPR: 
‘Where personal data have not been obtained from the data subject, the controller 
shall provide the data subject with the following information: 
REQUEST FOR A PRELIMINARY RULING OF 8. 2. 2023 – CASE C-169/23 
 
6  
Anonymised version 
(a) the identity and the contact details of the controller and, where applicable, of 
the controller’s representative; 
(b) the contact details of the data protection officer, where applicable; 
(c) the purposes of the processing for which the personal data are intended as 
well as the legal basis for the processing; 
(d) the categories of personal data concerned; 
(e) the recipients or categories of recipients of the personal data, if any; 
(f) where applicable, that the controller intends to transfer personal data to a 
recipient in a third country or international organisation …’ 
19 Article 14(5) of the GDPR: 
‘Paragraphs 1 to 4 shall not apply where and in so far as: 
(a) the data subject already has the information; 
… 
(c) obtaining or disclosure is expressly laid down by Union or Member State 
law to which the controller is subject and which provides appropriate measures to 
protect the data subject’s legitimate interests; or 
…’ 
20 Article 77(1) of the GDPR: 
‘Without prejudice to any other administrative or judicial remedy, every data 
subject shall have the right to lodge a complaint with a supervisory authority, in 
particular in the Member State of his or her habitual residence, place of work or 
place of the alleged infringement if the data subject considers that the processing 
of personal data relating to him or her infringes this Regulation.’ 
(B) Hungarian law 
Relevant provisions of the a koronavírus elleni védettségi igazolásról szóló 
60/2021. (II.12.) Korm. rendelet (Government Decree 60/2021 of 12 February 
on the coronavirus immunity certificate (the Government Decree)), as in force at 
the time when the defendant received the applicant’s complaint: 
21 Article 2(6) and (7): 
‘The certificate shall be issued by the Budapest Metropolitan Government Office 
(the issuing authority) in favour of the entitled natural person, either ex officio or 
on application.’ 
MÁSDI 
 
7 
Anonymised version 
22 Article 3(3): 
‘In the cases provided for in Article 2(6)(c) and (d), the [issuing] authority shall 
collect, by the automated transmission of information – where necessary through 
the relevant departments of the összerendelési nyilvántartás [Registry for the 
electronic organisation of identification data, Hungary] –, 
(a) from the EESZT [Elektronikus Egészségügyi Szolgáltatási Tér (Electronic 
Healthcare Service Space)] operator: the social security number of the person 
concerned, the data set out in Article 2(1)(e) and (g), and the data set out in 
paragraph 1; 
(b) from the body responsible for the recording of personal data and addresses: 
the name, document identifiers from the passport and permanent identity 
document, and address of the person concerned.’ 
23 Article 2(1): 
‘The immunity certificate shall contain: 
(a) the name of the person concerned; 
(b) the passport number of the person concerned, if he or she has a passport; 
(c) the number and document identifier of the permanent identity document of 
the person concerned, if he or she has a permanent identity document; 
(d) the serial number of the immunity certificate; 
(e) where proof of vaccination is provided, the date of vaccination; 
(f) where proof of recovery from infection is provided, the date of validity of 
the proof; 
(g) a data storage code that is optically readable by computing devices, 
generated using the data listed in (a) to (f); 
(h) the following wording in the form of text warnings: 
(ha) “In order to be valid, the card must be shown in conjunction with an identity 
document or passport”; 
(hb) “Not transferrable”; 
(hc) “The rights associated with the certificate may be viewed on the website 
koronavirus.gov.hu”.’ 
REQUEST FOR A PRELIMINARY RULING OF 8. 2. 2023 – CASE C-169/23 
 
8  
Anonymised version 
Grounds for initiating the preliminary ruling procedure and arguments of 
the parties 
24 The Kúria (Supreme Court) is a court against whose decisions there is no judicial 
remedy under national law. 
25 The legal basis of the proceedings pending between the parties is the GDPR, that 
is, secondary legislation in the form of a regulation, which requires interpretation 
as EU legislation that is directly applicable to the dispute, such interpretation 
being the responsibility of the Court of Justice (Article 267 TFEU). 
26 The Kúria (Supreme Court) has examined the conditions for initiating the 
preliminary ruling procedure laid down in the judgment in Cilfit and Others 
(283/81, EU:C:1982:335) and defined more precisely in the judgment in 
[Consorzio Italian Management and Catania Multiservizi] (C-561/19, 
EU:C:2021:799), and has concluded that those conditions are satisfied for the 
reasons set out below. 
27 In the first place, the questions referred are relevant to the decision on the merits 
of the case, since the success of the defendant’s appeal in cassation is dependant, 
inter alia, on: 
(a) whether the exception laid down in Article 14(5)(c) of the GDPR is 
applicable to the data processing at issue; 
(b) whether, in the complaint procedure provided for in Article 77(1) of the 
GDPR, the data subject is entitled to base his or her arguments on the second half-
sentence of Article 14(5)(c) of the GDPR; if that is the case, it will be necessary to 
interpret, in that provision, what the requirement to provide appropriate measures 
means for Member State law. 
28 In the second place, the Court of Justice has not yet interpreted the exception laid 
down in Article 14(5)(c) of the GDPR, which is applicable to the dispute, or 
Article 77(1) of the GDPR, read in conjunction with that exception. 
29 Although paragraph 66 of Guidelines WP 260 of the Article 29 Data Protection 
Working Party and, with broadly identical content, paragraph 41 of Guidelines 
03/2020 of the [European Data Protection Board] do interpret that exception to a 
certain extent, the working group’s interpretation cannot be classified as an 
authentic interpretation of EU law, since it is not an act of the Union within the 
meaning of Article 288 TFEU, it is not binding on the courts of the Member 
States, and it does not deal with the matters to be interpreted in the present 
dispute. 
30 In the third place, the interpretation of the applicable provisions of the GDPR is 
not so obvious as to leave no scope for any reasonable doubt, in view of the fact 
that: first, the chamber of the administrative court which heard this case, and 
which is composed of three career judges, and the chamber of the Kúria (Supreme 
MÁSDI 
 
9 
Anonymised version 
Court) which is now hearing the case, and which is composed of five career 
judges, interpret differently the first half-sentence of Article 14(5)(c) of the 
GDPR; second, the terms used in recital 62 of the GDPR differ from those in the 
enacting terms (recording/disclosure – obtaining/disclosure); and, third, in the 
light of the applicant’s arguments, the defendant also provided a different 
interpretation in relation to the legislative provision in question. 
31 The applicant submits that it is possible to take into consideration the exception 
laid down in Article 14(5)(c) of the GDPR only when the processing relates to 
data obtained from a person other than the data subject and that the exception is 
not applicable where the data are generated by the controller. In the applicant’s 
submission, the defendant’s approach would deprive of substance the right to 
receive information, and it is clear that that right is of paramount importance to 
the exercise of the rights of data subjects, in other words, for the purposes of 
ensuring that data subjects know what their rights are in relation to the processing 
in question. 
32 In contrast, the defendant contends that Article 14(5)(c) of the GDPR is applicable 
to the processing under examination. The defendant asserts that the GDPR 
differentiates between two levels of information to be provided to data subjects: 
on the one hand, Articles 13 and 14 of the GDPR govern information that is to be 
provided to data subjects even if they do not request it, while, on the other hand, 
Article 15 of the GDPR governs information which must be provided at the data 
subject’s request. Where the controller obtains personal data directly from the data 
subject, the information is to be provided in accordance with Article 13 of the 
GDPR, while, otherwise, the controller must proceed in accordance with 
Article 14. The defendant points out that the GDPR lays down a closed body of 
rules as regards the form in which information is to be provided and that, 
consequently, no data processing is, by its nature, excluded from the obligation to 
provide information. 
33 In the defendant’s submission, the processing at issue falls in its entirety within 
the objective scope of Article 14 of the GDPR and, therefore, given that that 
processing concerns data which ‘have not been obtained from the data subject’, 
the exception laid down in Article 14(5)(c) is applicable to the processing. 
34 In support of its arguments, the defendant refers to recital 62 of the GDPR, which, 
in relation to the exception – and unlike the wording used in the enacting terms – 
contains the words recording and disclosure of personal data. 
35 The defendant refers in its submissions to the judgment of the Court of Justice in 
Trapeza Peiraios (C-243/20, EU:C:2021:1045, paragraph 32 and the case-law 
cited), pursuant to which, where there is a disparity between the various language 
versions of a text of EU law, the provision in question must, in principle, be 
interpreted by reference to the general scheme and purpose of the rules of which it 
forms part. The defendant contends that it is apparent from a systematic 
interpretation of the provisions in question that recital 62 of the GDPR, with the 
REQUEST FOR A PRELIMINARY RULING OF 8. 2. 2023 – CASE C-169/23 
 
10  
Anonymised version 
concepts of registering/storage/recording, uses terms with a substantially broader 
meaning than the terms obtaining/collection and that, in addition, whereas 
Article 14(1) refers only to a processing operation (obtaining/collection), 
Article 14(5)(c) includes within the scope of the exception in all cases a number of 
processing operations (in addition to the obtaining of data, the exception also 
covers disclosure or publication, depending on the different language versions). 
36 The defendant submits that, from a systematic point of view, a comparison of the 
different provisions of the GDPR suggests that the objective scope of 
Article 14(5)(c) covers at least the same set of processing operations as 
Article 14(1). 
37 The defendant also has reasonable doubts concerning Article 77(1) of the GDPR, 
which governs the complaint procedure which may be initiated directly before the 
supervisory authority, read in conjunction with Article 14(5)(c) of the GDPR. 
38 The defendant contends that the second half-sentence of Article 14(5)(c) of the 
GDPR entails an examination of the appropriateness of the national legislation, 
which, in the defendant’s submission, requires the supervisory authority to 
conduct a kind of review procedure in respect of the legislation, in a situation 
where the supervisory authority does not have the power to examine whether a 
national provision is correct. 
39 The defendant argues that it is not possible to limit the right of complaint provided 
for in Article 77(1) of the GDPR, in other words the right to challenge an 
infringement of legislation relating to the processing of data concerning the data 
subject, and that in that case a data subject may request that the supervisory 
authority, as part of the complaint procedure, conduct an examination of the 
second half-sentence of Article 14(5)(c) of the GDPR. 
40 Lastly, by interpreting the phrase ‘appropriate measures to protect the data 
subject’s legitimate interests’ in the second half-sentence of Article 14(5)(c) of the 
GDPR, the Court of Justice will be able to provide the national court with a 
response that will be of assistance in resolving the dispute, identifying what the 
supervisory authority or the court with jurisdiction must examine in such a 
situation as regards the national legislation. 
41 The Kúria (Supreme Court) takes the view that the latter point will be relevant to 
the case should the Court of Justice confirm the position of the Kúria (Supreme 
Court) that is set out below, in which case it will be necessary to conduct new 
proceedings in which the first-instance court will also have to rule on that point. 
MÁSDI 
 
11 
Anonymised version 
Position of the Kúria (Supreme Court) on the questions referred for a 
preliminary ruling 
The first question 
42 The Kúria (Supreme Court) agrees, in essence, with the defendant’s viewpoint 
regarding the application of the exception laid down in Article 14(5)(c) of the 
GDPR, to the effect that the exception may apply to all types of processing which 
do not concern data collected from the data subject within the meaning of 
Article 13 of the GDPR. 
43 That would seem to be suggested by recital 62 of the GDPR, which, in using the 
word ‘recording’ rather than the word ‘obtaining’ used in the legislative act, also 
provides an interpretation of Article 14(5)(c) of the GDPR. 
44 The Kúria (Supreme Court) has examined the terms used in other language 
versions of the GDPR in the same place as the term ‘megszerzés’ in 
Article 14(5)(c) and the term ‘rögzítés’ in recital 62 of the Hungarian language 
version. As a result, it has established that in the enacting terms there are 
equivalent terms to the Hungarian in the following language versions: English 
(obtaining), German (Erlangung), French (obtention), Italian (ottenimento) and 
Spanish (obtención). However, in recital 62, the English (recording), Italian 
(registrazione) and French (enregistrement) language versions use words 
equivalent to the word ‘rögzítés’ (registering) in the Hungarian language version, 
whereas the German (Speicherung) and Spanish (conservación) language versions 
use a word equivalent to ‘tárolás’ (storage). 
45 As is apparent from the above, the difference is not between the different language 
versions but rather, above all, between the interpretation provided in the preamble 
and the term used in the enacting terms. Whereas the former refers to a wider 
group of processing operations, the term ‘obtaining’ used in the first half-sentence 
of Article 14(5)(c) of the GDPR refers to a more limited group of processing 
operations. 
46 Since the objective scope of Article 14 of the GDPR is determined primarily by 
paragraph 1 thereof and by the heading of the article itself, according to which 
that provision governs personal data which have not been obtained from the data 
subject, it is appropriate to conclude that the exception laid down in 
Article 14(5)(c) of the GDPR applies to the processing of all personal data which 
have not been obtained from the data subject and, therefore, also to data generated 
by the controller. 
The second question 
47 By its second question, the Kúria (Supreme Court) asks, in essence, whether the 
supervisory authority has the power to examine the subject of appropriate 
measures provided in national law to protect the data subject’s legitimate interests, 
REQUEST FOR A PRELIMINARY RULING OF 8. 2. 2023 – CASE C-169/23 
 
12  
Anonymised version 
to which the second half-sentence of Article 14(5)(c) of the GDPR refers; in other 
words, whether the supervisory authority has the power to examine the guarantees 
adopted by national law in accordance with the GDPR and whether, in the 
complaint procedure, the data subject – the applicant, in the present case – is 
entitled to request an assessment of whether a national provision is compatible 
with the GDPR. 
The third question 
48 Clearly, the Court of Justice is required to answer the third question only if it 
answers the second question to the effect that the supervisory authority has the 
power to conduct the examination and that the data subject, in exercising his or 
her right of complaint, is entitled to request an assessment of whether national law 
is compatible with the GDPR, in accordance with the second half-sentence of 
Article 14(5)(c) of the GDPR. 
49 The Kúria (Supreme Court) takes the view that it is not clear what the EU 
legislature means by the concept of appropriate measures to protect the data 
subject’s legitimate interests. 
50 The Kúria (Supreme Court) observes that, while it seems logical to state in answer 
to that question that ‘appropriate measures’ entail, on the one hand, the 
transposition into the national law concerned of the matters listed in 
Article 14(1)(a) to (f) of the GDPR and, on the other, the right to request an 
examination of the transposition of measures relating to the security of processing 
governed by Article 32 of the GDPR, it should be noted that encumbering 
legislation with technical provisions of that kind runs counter to the requirement 
for legislative acts to be intelligible and for rules to be clear, and that it could also 
be deemed to be a sufficient guarantee if such measures relating to the security of 
data are complied with by any affected body of the Member State, even where 
they have not been specifically transposed, and, in the event that a procedure is 
initiated before the supervisory body, that fact can be established by that body. 
Final part 
[…] [aspects of national procedural law] 
Budapest, 8 February 2023 
[signatures]