European judges provide initial guidance on the scope of a data controller’s liability in the event of a GDPR violation

Article published on June 28, 2023, in Le Monde du Droit -here. 

In the event of a cyberattack, data controllers are not automatically held civilly liable for a breach of the GDPR: the CJEU requires proof of the three standard conditions—breach, damage, and causation. The issue of liability exemption remains delicate, however, as the data controller must prove that its security measures were adequate, without being able to cite the actions of a third party as a basis for exemption. Finally, the debate over the threshold of severity for compensable non-pecuniary damage—on which the Court and the Advocate General disagree—is likely to determine the future scope of litigation in this area.