The European Court of Justice was set to deliver a decision that could have reshaped the landscape of GDPR enforcement. However, the Court has not followed the Opinion of the Advocate General (which it usually does). In most cases, the Data Protection Authority does not take any further action after receiving a notification of a data breach — in view of the limited resources available to the authority.
Had the Court followed the Opinion of the Advocate General in this case, Data Protection Authorities would have been required to investigate each and every personal data breach or infringement and would have been obligated to take action by identifying corrective measures to bring the situation back in compliance with the GDPR.