Article 77(1) and Article 79(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as precluding a supervisory authority, with which a complaint has been lodged under Article 77(1) of that regulation, from rejecting that complaint on the sole ground that judicial proceedings under Article 79(1) thereof, and concerning the same subject matter, have already been brought and even though the decision given in those proceedings is not yet final.

A court with jurisdiction to authorise disclosure of personal data to another judicial body is not required, of its own motion, to protect the persons concerned as regards compliance with Regulation 2016/679 provisions on the security of personal data where no action under Article 79(1) has been brought before it, even if that other body is known to have infringed those provisions in the past.

The remedies under Articles 77(1) and 78(1), on the one hand, and under Article 79(1), on the other, may be pursued concurrently and independently. It is for the Member States to lay down the detailed rules governing the relationship between those remedies so as to ensure effective protection of the rights guaranteed by the GDPR, the consistent and homogeneous application of the GDPR, and the right to an effective remedy before a court or tribunal under Article 47 of the Charter.