CJEU decision and non-pecuniary damage in personal data cases

Let’s dream about a bright future. 2029. Ukraine is in the EU, Russian War Ship went f*ck itself (haha). Let’s say our Supreme Court appeals to the EU Court of Justice and asks for clarification on a few issues regarding the GDPR. The court is very interested in how to award non-pecuniary damage to people whose data was published online after a large-scale data breach as a result of a hacker attack.

CJEU decision and non-pecuniary damage in personal data cases

The EU Court of Justice is like this: “Wait, guys! This has already happened,” and sends the Supreme Court a link to the CJEU decision of December 14, 2023, on a similar appeal from Bulgaria. There, the CJEU decided that:

  •  “Just because data has been leaked does not mean that the personal data controller is definitely guilty and should pull out their wallet;
  • The controller should be given a chance to prove that they are good and have taken appropriate information security measures (know how to distinguish between an infosec attack and a privacy policy);
  • The controller should prove the sufficiency and appropriateness of the measures, not the people affected, the police, or anyone else;
  • An expert’s opinion on the adequacy of protection does not stand alone; the court must evaluate the totality of the evidence;
  • Just because people suffered losses due to a data breach created by black-hat hackers does not mean that the controller has to compensate for those losses. The controller can try to prove that it is not responsible for these losses in any way;
  • To compensate for non-pecuniary damage, it is enough for a personal data subject to be frightened that their data may be misused by evil hackers due to a breach of the data controller’s duties.

 

We are not hinting at anything; all similarities with the Ukrainian situation are coincidental. We are simply saying that cybersecurity in the EU is sometimes underestimated, but it can cost you. The recent news about Ukraine and the EU is a great joy but also a great hassle because dreams will no longer be distant, and coincidences will no longer be random.

 

Link to CJEU Decision as of 14.12.2023.

0 Subscribe to the news