

Article 14(5)(c) and Article 77(1) of Regulation 2016/679 must be interpreted as meaning that, in a complaint procedure, the supervisory authority is competent to verify whether the Member State law to which the controller is subject provides appropriate measures to protect the data subject’s legitimate interests, for the purposes of the application of the exception laid down in Article 14(5)(c). That verification does not however cover the appropriateness of the measures which the controller is required to implement, under Article 32 of that regulation, in order to guarantee the security of processing of personal data.