Judgment_paragraph 43 · VB v Natsionalna agentsia za prihodite (C-340/21)

43It is true that the controller has some discretion in determining the appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32(1) of the GDPR. The fact remains that a national court must be able to evaluate the complex assessment carried out by the controller and, in so doing, make sure that the measures adopted by the controller are appropriate for the purposes of ensuring such a level of security.