ECJ: Data protection authorities do not have to impose sanctions
In judgment C-768/21 of 26 September 2024, the ECJ addressed the question of whether supervisory authorities are always obliged to punish a data protection breach under the GDPR. According to the ECJ, the data protection authorities have a margin of discretion.