Advocate General of the EU Court of Justice provides opinion on case of data breach by Bulgaria’s NAP
Advocate General of EU Court of Justice gives opinion on Case C-340/21, involving the 2019 data breach suffered by Bulgaria’s National Revenue Agency. The opinion stated that a data breach alone was not enough to determine if the controller had implemented appropriate measures. Non-material damage may be eligible for compensation if it is a matter of actual emotional damage.
The Advocate General of the Court of Justice of the European Union (CJEU) provided an opinion regarding Case C-340/21, which concerns the 2019 data breach suffered by Bulgaria’s National Revenue Agency (NAP). The breach led to the posting of taxpayers’ and social security information on the internet. The opinion stated that a data breach was not a sufficient condition to determine whether the controller had adopted appropriate and legally required measures. Many individuals, including V.B., filed claims for non-material damages of worry and fear of their personal data being misused in the future.
The court of first instance dismissed the application, ruling that the dissemination of the data was not attributable to the agency and that non-material damage was not eligible for compensation. On appeal, the Supreme Administrative Court referred several questions to the CJEU regarding the interpretation of the General Data Protection Regulation (GDPR) in defining the conditions for awarding compensation for non-material damage to individuals whose personal data was published on the internet following a hacking attack.
The Advocate General stated that a controller is responsible for implementing appropriate technical and organizational measures to ensure that the processing of personal data is performed by the GDPR and noted that non-material damage might constitute a right to compensation, provided that it is a matter of actual and specific emotional damage and not simply trouble or inconvenience.
About author
DW Team
The GIP Digital Watch Observatory team, consisting of over 30 digital policy experts from around the world, excels in the fields of research and analysis on digital policy issues. The team is backed by the creative prowess of Creative Lab Diplo and the technical expertise of the Diplo tech team.