From Privacy Litigation to Privacy Restoration: How to Manage the Questions of How, When, and Whether. Case Note: TR v. Land Hessen (Case C-768/21)

The highest judicial body has recently hit the headlines. In TR v. Land Hessen, the Court of Justice of the EuropeanUnion (CJEU) has clarified the obligations incumbent on a supervisory authority pursuant to the General Data Protection Regulation (GDPR). The CJEU highlights that supervisory authorities are not obliged to exercise ‘corrective’ powers if not necessary to remedy the breach. It clarifies that under the GDPR, supervisory authorities have discretion in addressing the shortcomings of a supervised entity but must ensure compliance with a higher level of data protection.