Hong Kong on Privacy

The European Court of Justice (ECJ) ruled in TR v Land Hessen (C-768/21) that a supervisory authority is not obligated to impose an administrative fine following a data breach under the GDPR if it is unnecessary, inappropriate, or disproportionate. Authorities have discretion to decide on corrective actions based on the specific circumstances of the breach. If the data controller has already taken necessary steps to address and prevent recurrence, a fine may not be imposed. This decision influen