(1)

Must Article 14(5)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (2) (‘the GDPR’), read in conjunction with Article 14(1) and recital 62 thereof, be interpreted as meaning that the exception laid down in Article 14(5)(c) does not refer to data generated by the controller in its own procedure but rather only to data which the controller has expressly obtained from another person?

(2)

If Article 14(5)(c) of the GDPR is also applicable to data generated by the controller in its own procedure, must the right to lodge a complaint with a supervisory authority, laid down in Article 77(1) of the GDPR, be interpreted as meaning that a natural person who alleges an infringement of the obligation to provide information is entitled, when exercising his or her right to lodge a complaint, to request an examination of whether Member State law provides appropriate measures to protect the data subject’s legitimate interests, in accordance with Article 14(5)(c) of the GDPR?

(3)

If the answer to the second question is in the affirmative, may Article 14(5)(c) of the GDPR be interpreted as meaning that the ‘appropriate measures’ referred to in that provision require the national legislature to transpose (by means of legislation) the measures relating to the security of data laid down in Article 32 of the GDPR?