Cyberattacks and unauthorized access to personal data: What are the consequences for the data controller?

Article published on September 7, 2023, in *La Lettre des Juristes d'Affaires*— here. 

The CJEU has clarified the scope of data controllers’ liability in the event of a GDPR violation, ruling out any automatic liability and requiring the standard demonstration of a breach, harm, and a causal link. The issue of compensation for non-pecuniary damage remains uncertain, however, as the Court and the Advocate General have adopted approaches that are difficult to reconcile regarding the level of severity required to give rise to a right to compensation. These clarifications, combined with ongoing reforms regarding class actions, could nevertheless lead to a significant increase in litigation against data controllers.