ECJ: GDPR Damages Claim after Cyber Attack

The European Court of Justice (“ECJ“) delivered a judgment on 14 December 2023 in case C-340/21, addressing issues related to the right to compensation under Article 82 of the GDPR following a cyber attack on a Bulgarian authority. The ECJ clarified that unauthorized disclosure of personal data after a cyber attack can trigger liability for damages under Article 82 of the GDPR. The data controller must demonstrate that the technical and organizational measures (“TOMs”) taken were “appropriate” as per Articles 24 and 32 of the GDPR. Additionally, the ECJ detailed how national courts should assess the appropriateness of these measures. The present case is a textbook example of the type of cyber attacks that occur daily in very high numbers.

Facts of the Case

During a cyber attack on the Bulgarian National Revenue Agency (“NRA“), hackers accessed and published personal data online, affecting over six million individuals. Several hundred affected parties, including the plaintiff, subsequently sued the NRA for compensation for non-material damage due to the potential misuse of their personal data. The NRA responded by claiming it had taken all necessary defensive measures. After the plaintiff initially prevailed at the court of first instance, the claim was dismissed as unfounded at the court of second instance. The Supreme Administrative Court of Bulgaria then referred the case to the ECJ for a decision on the European law aspects.

Questions referred to the ECJ

The decision pertains to six questions decided by the ECJ:

Does unauthorized data disclosure or access by third parties always indicate that security measures are not appropriate in accordance with Articles 24 and 32 of the GDPR?
How should the assessment of security measures under Article 32 of the GDPR be conducted by national courts?
Must the data controller prove that their measures were appropriate under Articles 5 (2), 24, and 32 of the GDPR in the event of a claim for damages?
Is a judicial expert opinion a necessary and sufficient means of evidence to assess the adequacy of security measures under Article 32 of the GDPR?
Is a controller exempt from liability under Article 82 (3) of the GDPR solely because the damage resulted from a disclosure by a third party?
Does the fear of future misuse constitute non-material damage under Article 82 (1) and (2) of the GDPR?

Unauthorized disclosure by third parties alonedoes not necessarily indicate that implemented TOMs are not appropriate

The ECJ explains that a breach does not prove the TOMs were not appropriate. Article 32 of the GDPR requires a risk management system that doesn't eliminate all data protection risks but minimizes them significantly. The assessment of the TOMs’ appropriateness shall involve analyzing the risks to personal data protection, considering their likelihood and severity, and then evaluating the adequacy of the measures implemented, taking into account the state of the art, cost of implementation, and nature, scope, circumstances, and purposes of the data processing. Therefore, even in the event of unauthorized disclosure, the controller can prove that the measures taken were appropriate.

Concrete Assessment of TOMs by National Courts

National courts must concretely assess the adequacy of implemented TOMs in two steps: In a first stage, by examining the conducted risk analysis and, in a second stage, by evaluating the appropriateness of the measures taken. This involves a concrete examination of the nature and content of the measures taken by the controller and their practical effects on the protection level corresponding to the risk.

Controller Bears Burden of Proof regarding Appropriateness of TOMs

In a compensation claim based on Article 82 of the GDPR, the controller responsible for the data processing bears the burden of proof that the security measures taken were appropriate.

Expert’s Report Not Generally Sufficient for Assessment of TOMs

In a court procedure, the national court must conduct an independent objective assessment of the appropriateness of security measures as per Article 32 of the GDPR. It is neither generally sufficient nornecessary for the court to base its decision solely on an expert’s report. The court must perform "a concrete analysis of both the nature and the content of the measures implemented by the controller, the manner in which those measures were applied and their practicaleffects on the level of security that the controller was required to guarantee. "

No exemption from liability for damages in the event of data disclosure by third parties

A controller is not exempt from liability under Article 82 (3) GDPR solely due to the fact that the damage is the result of unauthorised access or unauthorised disclosure by a third party within the meaning of Article 4 no. 10 GDPR. The controller must prove that it is not responsible in any way for the circumstance that caused the damage. There must therefore be no causal link between the breach of the data protection obligation by the data controller and the damage suffered by the data subject.

Fear of improper use of data is sufficient for non-material damage

It is not necessary for the disclosed data to have already been misused in order to claim non-material damage. The mere loss of control over the data and the associated concern of the data subject that such use could occur in the future is sufficient for the existence of damage.

Conclusion

With this decision, the ECJ has clarified the conditions for the claim for damages under Article 82 (1) of the GDPR after a cyber attack. In practice, this decision makes it clear that every cyber attack has the potential to trigger a multitude of claims for damages. In particular, the fact that for the occurrence of a damage it is not necessary that the data has already been misused facilitates the claim of damages for affected persons. The possibilities for the national legislator to restrict the claim for damages under Article 82 GDPR by introducing a de minimis threshold have already been ruled in another decision by the ECJ from December 14, 2023 (C-456/22) as not compatible with the GDPR. Therefore, even with low individual damages, the risk of significant financial harm to the company persists due to the large number of possibly affected data subjects. This is even more significant in today's environment, as a variety of service providers offer individuals easy options to check if their data has been compromised in a cyber attack or data breach. Companies can only effectively defend themselves if they can demonstrate and prove that their TOMs were appropriate for data protection. Hence, it is recommended that the TOMs are strictly based on a comprehensive risk analysis and always comply with current technical standards.The evaluation should be carefully documented for evidence purposes. For risk assessment, implementation of an appropriate data protection system, and review of your data protection concept, we are always at your disposal.