65In that regard, as has been observed in paragraphs 45 and 48 of the present judgment, the substantive conditions which a supervisory authority must satisfy when it imposes an administrative fine on a controller are governed solely by EU law, since those conditions are laid down, in detail and without leaving any discretion to the Member States, in Article 83(1) to (6) of the GDPR (see also judgment of 5 December 2023, Nacionalinis visuomenės sveikatos centras, C‑683/21, EU:C:2023:XXX, paragraphs 64 to 70).
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.