CJEU - C‑340/21 - Natsionalna agentsia za prihodite
| CJEU - C‑340/21 Natsionalna agentsia za prihodite | |
|---|---|
 | |
| Court: | CJEU |
| Jurisdiction: | European Union |
| Relevant Law: | Article 5 GDPR Article 24 GDPR Article 32 GDPR Article 82 GDPR |
| Decided: | 14.12.2023 |
| Parties: | |
| Case Number/Name: | C‑340/21 Natsionalna agentsia za prihodite |
| European Case Law Identifier: | ECLI:EU:C:2023:986 |
| Reference from: | |
| Language: | 24 EU Languages |
| Original Source: | AG Opinion Judgement |
| Initial Contributor: | sh |
The CJEU ruled that the fear of a data subject over the possible misuse of their data from a data breach counts as a non-material damage and can lead to financial compensation from the controller. The burden of proof is on the controller to prove that appropriate measures were adopted against the cyberattack.
English Summary
Facts
The Bulgarian Tax Agency (the controller) suffered a data breach. As a result, more than 6 million people's personal data was leaked online, including that of the complainant.
The complainant sued the controller in the Aministrative Court Sofia under the basis of Article 82 GDPR. She requested around €510 as compensation for the non-material damage[1] resulting from the breach. She argued that the controller had caused the damage because they had failed to implement adequate Technical and Organisational Measures (TOMs) in breach of Article 5(1)(f) , 24 and 32 GDPR. Her non-material damage was the fear that her personal data, might be misused in the future and that she could be threatened as a consequence.
The Administrative Court Sofia dismissed the action. Firstly, the controller had not caused the breach because the breach had resulted from the actions of third parties. Secondly, the complainant had not proved that the controller had failed to implement security measures. Laslty, in the courts opinion the complainant had not suffered an actual non-material damage, since her fear was only hypothetical she could not be granted compensation.
The complainant appealed this decision before the Supreme Administrative Court Bulgaria, who referred the case to the CJEU with the following questions:
1) Do Articles 24 and 32 GDPR mean that a data breach, as defined by Article 4(12) GDPR by, is sufficient to presume that the TOMs implemented by the controller are insufficient?
2) If the first question is answered in the negative, what should be the scope of the court's judicial review into whether the TOMs are approproate under Article 32 GDPR be?
3) If the first question is answered in the negative, is the burden on the controller to prove that the implemented TOMs are appropriate under Article 32 GDPR?
4) Does Article 82(3) GDPR allow the controller to be exempt from liability for damages if the data breach as defined by 4(12) GDPR was caused by third parties outside of the controller's control?
5) Does Article 82(1) and (2) GDPR allow the anxiety caused by a hacking attack to constitute a non-material damage and entitle the complainant to damages even though they have not suffered further harm?
Holding
The CJEU decided that the burden of proof over proving that TOMs are adequate lies with the data controller, and it granted the complainant damages for the data breach.
On the notion of technical and secure measures under Articles 24 and 32:
On the first question, the fact that a third party breached a controller does not automatically mean the TOMs of the controller were inadequate. Article 24 GDPR imposes on the controller a general obligation to implement appropriate TOMs to ensure that processing is carried out in accordance with the GDPR and that this can be demonstrated. Article 32 GDPR also requires the controller to implement a "level of security appropriate to the risk." The language of Article 32 demonstrates that the GDPR's goal is only to establish a risk management system, not to eliminate the risks of personal data breaches. Thus, Articles 24 and 32 GDPR imply that the GDPR merely requires the controller to implement TOMs in order to avoid any personal data breach, if at all possible. It cannot be inferred from this language that a breach is sufficient to conclude that the measures were not appropriate, without even allowing the controller to argue otherwise. This is particularly significant because Article 24 GDPR expressly states that the controller must be able to demonstrate that the measures implemented comply with the regulation, a possibility that would be lost if an irrebuttable presumption were accepted.
On the second question, the court decided that the appropriateness of TOMs must be assessed by national courts. Such an interpretation is capable of ensuring the protection of personal data and the right to an effective judicial remedy against the controller under Article 79(1) GDPR. Having said that, Article 32(1) and (2) GDPR make it clear that national courts must assess the appropriateness of TOMs in two stages. First, the court must identify the risks of a breach and the potential consequences of those risks. Second, the court must determine whether the controller's TOMs are appropriate to the risks. A national court cannot confine itself to investigating how the controller aimed to comply with Article 32 but rather needs to examine the substance of the TOMs in light of the criteria set out in Article 32 GDPR.
On the third question, the court split it into two parts. First, does the principle of accountability under Article 5(2) and 24 GDPR mean that the burden of proof is on the controller to prove the adequacy of their TOMs in the context of damages? Second, does an experts report constitute sufficient means of proof that the TOMs were adequate? The court determined that the controller bears the burden of proving the adequacy of TOMs, particularly in the context of damages under Article 82 GDPR. The wording of Articles 5(2), 24(1), and 32(1) GDPR makes this clear. Furthermore, if the burden of proof for the appropriateness of those measures falls on the data subjects, the right to compensation provided for in Article 82(1) of the GDPR would lose its effectiveness, as the data subject would never be able to prove such a point. In terms of expert reports, the court determined that they are neither necessary nor sufficient proof. It is for the Member States to judge the types of evidence that make it possible to assess the appropriateness of TOMs, subject to compliance with those principles of equivalence and effectiveness.[2] If the court would decide that an expert report was automatically 'sufficient' then it would undermine this flexibility.
On the notion of damages:
On the fourth question, the court decided that Article 83(2) means that the controller cannot be exempt from liability for damages just because the damage was caused by third parties (a third party means anyone not authorised to process the data). The wording of Article 82(2) GDPR and Recital 146 make it clear that the controller is responsible for compensating damage caused by GDPR-infringement processing. To be exempt, the controller must demonstrate that the act that caused the damage was not attributable to it. This is supported by the fact that Article 82(2) GDPR states that the controller can only be exempt if it can demonstrate 'in any way' that it is not responsible for the damage. As a result, the circumstances in which the controller may claim to be exempt from liability under Article 82 GDPR must be strictly limited to those in which the controller can demonstrate that there is no casual link between its possible breach of the GDPR and the damage suffered by the natural person.
On the fifth question, the court decided that Article 82(1) includes the fear of the potential misuse of personal data that a data subject feels as a result of a breach. This fear is therefore sufficient to give rise to non-material damages and compensation. The wording of Article 82(1) GDPR is broad and does not require the non-material damage to be linked to the misuse of the data at the date of compensation. This interpretation is supported by CJEU - C-300/21 - Österreichische Post AG where it stated that the concept of damage has to be interpreted broadly. Lastly, Recital 85 includes a situation where the mere loss of control over data results in a data breach, suggesting that this is again enough to allow for damages. The national court must ensure, however, that the fear over the misuse of the data is not unfounded and that it is related to the specific circumstances at issue with the data subject.
Comment
This case, especially when combined with CJEU - C-300/21 - Österreichische Post AG which determines that there is no minimum threshold for non-material damages, will likely open the gateway for class action law suits.
Further Resources
Share blogs or news articles here!
- ↑ The GDPR gives you a right to claim compensation from an organisation if you have suffered damage as a result of it breaking data protection law. This includes both “material damage” (e.g. you have lost money) or “non-material damage” (e.g. you have suffered distress).
- ↑ (see, by analogy, judgments of 21 June 2022, Ligue des droits humains, C‑817/19, EU:C:2022:491, paragraph 297, and of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data), C‑300/21, EU:C:2023:370, paragraph 54).
