Article 77 - Right to lodge a complaint with a supervisory authority
5 preliminary rulingsJudgment of 14 Jul 2026, C-474/24 (NADA Austria and Others) 
Article 77 of Regulation 2016/679 must be interpreted as meaning that a complaint lodged on the basis of that article, seeking to prevent the publication on the internet of personal data relating to the infringement of anti-doping rules, is admissible where, on the date on which that complaint is lodged with the competent supervisory authority, there are specific indications that that publication is imminent or will take place in the near future.
Judgment of 18 Jun 2026, C-414/24 (Datenschutzbehörde)
Article77(1) and Article79(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as precluding a supervisory authority, with which a complaint has been lodged under Article77(1) of that regulation, from rejecting that complaint on the sole ground that judicial proceedings under Article79(1) thereof, and concerning the same subject matter, have already been brought and even though the decision given in those proceedings is not yet final.
Judgment of 28 Nov 2024, C-169/23 (Másdi)
Article 14(5)(c) and Article 77(1) of Regulation 2016/679 must be interpreted as meaning that, in a complaint procedure, the supervisory authority is competent to verify whether the Member State law to which the controller is subject provides appropriate measures to protect the data subject’s legitimate interests, for the purposes of the application of the exception laid down in Article 14(5)(c). That verification does not however cover the appropriateness of the measures which the controller is required to implement, under Article 32 of that regulation, in order to guarantee the security of processing of personal data.
Judgment of 16 Jan 2024, C-33/22 (Österreichische Datenschutzbehörde)
Article 77(1) and Article 55(1) of Regulation 2016/679 must be interpreted as meaning that, where a Member State has chosen, in accordance with Article 51(1) of that regulation, to establish a single supervisory authority, without, however, conferring on it the competence to monitor the application of that regulation by a committee of inquiry set up by that Member State’s parliament in the exercise of its power of scrutiny over the executive, those provisions directly confer on that authority the competence to hear complaints relating to the processing of personal data by that committee of inquiry.
Judgment of 12 Jan 2023, C-132/21 (Budapesti Elektromos Művek Zrt.)
Article 77(1), Article 78(1) and Article 79(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in the light of Article 47 of the Charter of Fundamental Rights of the European Union, must be interpreted as permitting the remedies provided for in Article 77(1) and Article 78(1) of that regulation, on the one hand, and Article 79(1) thereof, on the other, to be exercised concurrently with and independently of each other. It is for the Member States, in accordance with the principle of procedural autonomy, to lay down detailed rules as regards the relationship between those remedies in order to ensure the effective protection of the rights guaranteed by that regulation and the consistent and homogeneous application of its provisions, as well as the right to an effective remedy before a court or tribunal as referred to in Article 47 of the Charter of Fundamental Rights.
