Referral C-768/21 (Land Hessen, 14 Dec 2021)

Are Article 57(1)(a) and (f) and Article 58(2)(a) to (j) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, ‘the GDPR’, OJ 2016 L 119, p. 1), read in combination with Article 77(1) thereof, to be understood as meaning that, where the supervisory authority finds that data processing has infringed the data subject’s rights, the supervisory authority must always take action in accordance with Article 58(2) of the GDPR?