In the judgement Másdi (C- 169/23), the Court of Justice ruled on the interpretation of Article 14(5)(c) GDPR. The preliminary reference request concerned the claim presented by UC, a natural person, that the Budapest Metropolitan Government Office violated the GDPR by not publishing a privacy notice on the processing of personal data relating to the COVID-19 vaccine certificate. Furthermore, UC claimed that there was insufficient information concerning the purpose and legal basis of the processing, the rights available to data subjects, and how those rights could be exercised. The action was dismissed by the Hungarain supervisory authority on the basis that the derogation laid down in Article 14(5)(c) of the GDPR was applicable. This decision was reversed by the Budapest High Court on the basis that some of the data in connection with the immunity certificates were generated by that controller. The Supreme Court stayed the proceedings and referred to the Court of Justice three questions concerning the scope and interpretation of this provision. The Court found that the exception outlined in Atrticle 15(5)(c) of the GDPR applies to all personal data that the data controller did not collect directly from the data subject.