Case C-169/23, Másdi: Judgment of the Court (Third Chamber) of 28 November 2024 (request for a preliminary ruling from the Kúria – Hungary) – Nemzeti Adatvédelmi és Információszabadság Hatóság v UC (Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data and the free movement of such data – Regulation (EU) 2016/679 – Data processed when drawing up a COVID-19 certificate – Data not collected from the data subject – Information to be provided – Exception to the obligation to provide information – Article 14(5)(c) – Data generated by the controller in the context of its own processes – Right to complain – Competence of the supervisory authority – Article 77(1) – Appropriate measures to protect the data subject’s legitimate interests provided for by the Member State law to which the controller is subject – Measures relating to the security of data processing – Article 32)
Date: 2024-11-28
Institutions: Court of Justice
Subjects: coronavirus disease, data protection, data-processing law, disclosure of information, epidemic, health certificate, personal data








C_202500366EN.000101.fmx.xml












Official Journal of the European Union


EN
C series













C/2025/366


27.1.2025






Judgment of the Court (Third Chamber) of 28 November 2024 (request for a preliminary ruling from the Kúria – Hungary) – Nemzeti Adatvédelmi és Információszabadság Hatóság v UC


(Case C-169/23,
                (1)
Másdi)
                (2)

(Reference for a preliminary ruling - Protection of natural persons with regard to the processing of personal data and the free movement of such data - Regulation (EU) 2016/679 - Data processed when drawing up a COVID-19 certificate - Data not collected from the data subject - Information to be provided - Exception to the obligation to provide information - Article 14(5)(c) - Data generated by the controller in the context of its own processes - Right to complain - Competence of the supervisory authority - Article 77(1) - Appropriate measures to protect the data subject’s legitimate interests provided for by the Member State law to which the controller is subject - Measures relating to the security of data processing - Article 32)
(C/2025/366)
Language of the case: Hungarian

Referring court

Kúria

Parties to the main proceedings


Applicant: Nemzeti Adatvédelmi és Információszabadság Hatóság

Defendant: UC

Operative part of the judgment







1.


Article 14(5)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
must be interpreted as meaning that the exception to the controller’s obligation to provide information to the data subject, laid down in that provision, concerns all personal data, without distinction, that have not been collected by the controller directly from the data subject, whether those data have been obtained by the controller from a person other than the data subject or whether they have been generated by the controller itself, in the performance of its tasks.










2.


Article 14(5)(c) and Article 77(1) of Regulation 2016/679
must be interpreted as meaning that, in a complaint procedure, the supervisory authority is competent to verify whether the Member State law to which the controller is subject provides appropriate measures to protect the data subject’s legitimate interests, for the purposes of the application of the exception laid down in Article 14(5)(c). That verification does not however cover the appropriateness of the measures which the controller is required to implement, under Article 32 of that regulation, in order to guarantee the security of processing of personal data.






(1)  
            OJ C 205, 12.6.2023.

(2)  The name of the present case is a fictitious name. It does not correspond to the real name of any party to the proceedings.


ELI: http://data.europa.eu/eli/C/2025/366/oj
ISSN 1977-091X (electronic edition)