# Liability — legal context bundle

> Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/liability
> Sources are cited per item. Verify against the official texts before relying on them.

Legal responsibility for GDPR violations and damages

## Overview

## Legal Framework

Article 82 GDPR is the governing provision for compensation and liability allocation. Under [Article 82(1)](/laws/gdpr/art-82#par-1), any person who has suffered material or non-material damage as a result of a GDPR infringement may claim compensation from the controller or processor responsible.

> "Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered."
> — [GDPR Art. 82(1)](/laws/gdpr/art-82#par-1)

The liability regime draws a critical distinction between controllers and processors. Article 82(2) makes a controller liable for damage caused by any infringing processing, whereas a processor's liability is narrower—attaching only where it failed to comply with processor-specific obligations or acted outside or contrary to lawful instructions. Both controllers and processors may invoke the exemption under Article 82(3), which shifts the burden of proof to the defendant:

> "A controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way responsible for the event giving rise to the damage."
> — GDPR Art. 82(3)

Where multiple parties participate in the same processing, Article 82(4) imposes liability for the entire damage on each responsible party, with a corresponding right of recourse under Article 82(5) based on respective shares of responsibility.

## Key Developments

Enforcement decisions confirm that inadequate technical and organisational measures directly generate liability exposure. In the Permanent TSB enforcement action, the Irish DPA linked organisational failures to concrete vulnerability of data subjects, reinforcing that supervisory authorities treat the severity and likelihood of harm as key parameters when assessing consequences of infringement.

> "A breach can potentially have a range of significant adverse effects on individuals, which can result in physical, material, or non-material damage."
> — [EDPB Guidelines 9/2022 §24](/posts/38058#seg-24)

National DPAs have imposed substantial fines where controllers failed to prevent such damage: the Lithuanian DPA fined two medical companies €450,000 following data breaches involving unauthorised access to internal systems, while the Croatian DPA fined a gas station operator €940,000. These decisions signal that both the number of affected individuals and the level of damage suffered inform supervisory assessment of liability consequences.

## Status of the Debate

This topic is contested in court. While Article 82 provides a structured liability framework, member state courts diverge on key thresholds—particularly the standard for proving causation between an infringement and actual damage, and the precise scope of the Article 82(3) exemption. The CJEU has addressed adjacent questions in *Mousse* (C-394/23) regarding legitimate interests and risk to data subjects, but has not yet ruled definitively on the boundaries of the Article 82 liability regime. No court split has been formally resolved through a preliminary reference on the meaning of "not in any way responsible" or on whether non-material damage requires concrete manifestation. A CJEU reference on those questions would settle the most pressing open issues.

## Practical Guidance

- **Document accountability for each processing operation**: Controllers bear broader liability under Article 82(2) than processors; maintain records demonstrating lawfulness and adequacy of measures to support a potential Article 82(3) exemption defence.
- **Allocate liability precisely in processor contracts**: Under Article 82(5), a party paying full compensation may reclaim from co-responsible parties; contracts should pre-define responsibility shares to streamline recourse claims.
- **Maintain evidence of compliance for the Article 82(3) exemption**: The burden of proving non-responsibility rests on the controller or processor; risk assessments, security audit logs, and incident response records are essential to discharge that burden.
- **Assess damage severity proactively following breaches**: EDPB guidelines and national enforcement confirm that both the number of affected individuals and the level of damage suffered inform supervisory action; breach impact assessments should document both dimensions.
- **Prepare for joint liability scenarios**: Where multiple controllers or processors share a processing activity, Article 82(4) makes each liable for the entire damage; contractual indemnities should reflect this exposure.

## Legislation (full text of key provisions)

### Right to compensation and liability

*Source: GDPR, gdpr-art-82-en, 2016-04-27 — https://overview.legal/posts/91364*

### Recital 17 — intermediary service provider liability exemptions

*Source: DSA, dsa-rec-17-en, 2022-10-19 — https://overview.legal/posts/95431*

The rules on liability of providers of intermediary services set out in this Regulation should only establish when the provider of intermediary services concerned cannot be held liable in relation to illegal content provided by the recipients of the service. Those rules should not be understood to provide a positive basis for establishing when a provider can be held liable, which is for the applicable rules of Union or national law to determine. Furthermore, the exemptions from liability established in this Regulation should apply in respect of any type of liability as regards any type of illegal content, irrespective of the precise subject matter or nature of those laws.

### Recital 23 — service provider control liability exemption exception

*Source: DSA, dsa-rec-23-en, 2022-10-19 — https://overview.legal/posts/95443*

The exemption of liability should not apply where the recipient of the service is acting under the authority or the control of the provider of a hosting service. For example, where the provider of an online platform that allows consumers to conclude distance contracts with traders determines the price of the goods or services offered by the trader, it could be considered that the trader acts under the authority or control of that online platform.

### Recital 16 — conditional intermediary liability exemptions framework

*Source: DSA, dsa-rec-16-en, 2022-10-19 — https://overview.legal/posts/95429*

The legal certainty provided by the horizontal framework of conditional exemptions from liability for providers of intermediary services, laid down in Directive 2000/31/EC, has allowed many novel services to emerge and scale up across the internal market. That framework should therefore be preserved. However, in view of the divergences when transposing and applying the relevant rules at national level, and for reasons of clarity and coherence, that framework should be incorporated in this Regulation. It is also necessary to clarify certain elements of that framework, having regard to the case-law of the Court of Justice of the European Union.

### Recital 18 — Active role liability exemption exclusion

*Source: DSA, dsa-rec-18-en, 2022-10-19 — https://overview.legal/posts/95433*

The exemptions from liability established in this Regulation should not apply where, instead of confining itself to providing the services neutrally by a merely technical and automatic processing of the information provided by the recipient of the service, the provider of intermediary services plays an active role of such a kind as to give it knowledge of, or control over, that information. Those exemptions should accordingly not be available in respect of liability relating to information provided not by the recipient of the service but by the provider of the intermediary service itself, including where the information has been developed under the editorial responsibility of that provider.

### Recital 21 — liability exemptions for intermediary services

*Source: DSA, dsa-rec-21-en, 2022-10-19 — https://overview.legal/posts/95439*

A provider should be able to benefit from the exemptions from liability for ‘mere conduit’ and for ‘caching’ services when it is in no way involved with the information transmitted or accessed. This requires, among other things, that the provider does not modify the information that it transmits or to which it provides access. However, this requirement should not be understood to cover manipulations of a technical nature which take place in the course of the transmission or access, as long as those manipulations do not alter the integrity of the information transmitted or to which access is provided.

### Recital 26 — voluntary moderation liability exemption good faith

*Source: DSA, dsa-rec-26-en, 2022-10-19 — https://overview.legal/posts/95449*

In order to create legal certainty, and not to discourage activities that aim to detect, identify and act against illegal content that providers of all categories of intermediary services undertake on a voluntary basis, it should be clarified that the mere fact that providers undertake such activities does not render unavailable the exemptions from liability set out in this Regulation, provided those activities are carried out in good faith and in a diligent manner. The condition of acting in good faith and in a diligent manner should include acting in an objective, non-discriminatory and proportionate manner, with due regard to the rights and legitimate interests of all parties involved, and providing the necessary safeguards against unjustified removal of legal content, in accordance with the objective and requirements of this Regulation. To that aim, the providers concerned should, for example, take reasonable measures to ensure that, where automated tools are used to conduct such activities, the relevant technology is sufficiently reliable to limit to the maximum extent possible the rate of errors. In addition, it is appropriate to clarify that the mere fact that the providers take measures, in good faith, to comply with the requirements of Union law, including those set out in this Regulation as regards the implementation of their terms and conditions, should not render unavailable the exemptions from liability set out in this Regulation. Therefore, any such activities and measures that a provider may have taken should not be taken into account when determining whether the provider can rely on an exemption from liability, in particular as regards whether the provider provides its service neutrally and can therefore fall within the scope of the relevant provision, without this rule however implying that the provider can necessarily rely thereon. Voluntary actions should not be used to circumvent the obligations of providers of intermediary services under this Regulation.

### Recital 127 — minimum enforcement powers and proportionate penalties

*Source: NIS2, nis2-rec-127-en, 2022-12-14 — https://overview.legal/posts/96782*

In order to make enforcement effective, a minimum list of enforcement powers that can be exercised for breach of the cybersecurity risk-management measures and reporting obligations provided for in this Directive should be laid down, setting up a clear and consistent framework for such enforcement across the Union. Due regard should be given to the nature, gravity and duration of the infringement of this Directive, the material or non-material damage caused, whether the infringement was intentional or negligent, actions taken to prevent or mitigate the material or non-material damage, the degree of responsibility or any relevant previous infringements, the degree of cooperation with the competent authority and any other aggravating or mitigating factor. The enforcement measures, including administrative fines, should be proportionate and their imposition should be subject to appropriate procedural safeguards in accordance with the general principles of Union law and the Charter of Fundamental Rights of the European Union (the ‘Charter’), including the right to an effective remedy and to a fair trial, the presumption of innocence and the rights of the defence.

### Recital 85 — personal data breach notification requirements

*Source: GDPR, gdpr-rec-85-en, 2016-04-27 — https://overview.legal/posts/91685*

A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned. Therefore, as soon as the controller becomes aware that a personal data breach has occurred, the controller should notify the personal data breach to the supervisory authority without undue delay and, where feasible, not later than 72 hours after having become aware of it, unless the controller is able to demonstrate, in accordance with the accountability principle, that the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where such notification cannot be achieved within 72 hours, the reasons for the delay should accompany the notification and information may be provided in phases without undue further delay.

### Recital 101 — multiple-stage significant incident reporting

*Source: NIS2, nis2-rec-101-en, 2022-12-14 — https://overview.legal/posts/96730*

This Directive lays down a multiple-stage approach to the reporting of significant incidents in order to strike the right balance between, on the one hand, swift reporting that helps mitigate the potential spread of significant incidents and allows essential and important entities to seek assistance, and, on the other, in-depth reporting that draws valuable lessons from individual incidents and improves over time the cyber resilience of individual entities and entire sectors. In that regard, this Directive should include the reporting of incidents that, based on an initial assessment carried out by the entity concerned, could cause severe operational disruption of the services or financial loss for that entity or affect other natural or legal persons by causing considerable material or non-material damage. Such initial assessment should take into account, inter alia, the affected network and information systems, in particular their importance in the provision of the entity’s services, the severity and technical characteristics of a cyber threat and any underlying vulnerabilities that are being exploited as well as the entity’s experience with similar incidents. Indicators such as the extent to which the functioning of the service is affected, the duration of an incident or the number of affected recipients of services could play an important role in identifying whether the operational disruption of the service is severe.

## Case law

### German Supreme Court: GDPR non-material damages need no severity threshold

*Source: German Supreme Court, 2025-01-28 — https://overview.legal/posts/125638 — original: https://gdprhub.eu/index.php?title=BGH_VI_ZR_109/23*

Facts — The data subject, a private individual, objected to the controller’s processing of their personal data. The controller, a commercial entity, had collected and processed the data subject’s personal data for marketing and profiling purposes. The data subject sent an email to the controller objecting to such a “processing or use” of his data to which the controller failed to respond The data subject claimed that the processing was unlawful and requested its cessation under Article 17(1)(d) GDPR. The data subject claimed that, when he receives messages of this nature, it gives rise to an uneasy feeling that personal data has been disclosed to unauthorized persons, precisely because the data was unlawfully used. The data subject had to deal with unwanted advertising and the origin of the data, creating a quite stressful impression of loss of control. Moreover, the controller initially did not respond after the infringement, which, from the data subject’s perspective, constituted yet another disregard of him. The controller argued that its processing was justified under Article 6(1)(f) GDPR as a legitimate interest. The lower courts had differing views on whether the processing met GDPR standards. Holding — The court stated, that a claim for non-material damages cannot be denied on the grounds that the harm does not exceed a certain severity threshold. However the court found, that the data subject did not sufficiently demonstrate that he suffered non-material damage at all. The court stated that the CJEU had clarified in several judgements that a mere infringement of the provisions of the GDPR is not sufficient to establish a claim for damages; rather, as an independent prerequisite, actual damage (caused by the infringement) must also be demonstrated by the data subject. The court elaborated that once the loss of control is established this itself constitutes the non-material damage, and there is no need for further distinct or additional concerns or anxieties on the part of the data subject. The court held, that in the current case a loss of control could at most be presumed if the controller had made the data subject’s data accessible to third parties when sending the advertising email which the controller did not. The court also held, that where loss of control cannot be established, it suffices for a damages claim that the individual affected demonstrates a well-founded fear that his personal data would be misused by unauthorized third parties as a result of the GDPR infringement. However, the court held that a mere assertion of fear without any proven negative consequences is insufficient, as is a purely hypothetical risk of misuse by an unauthorized third party. The court considered that the data subject had submitted that he fears the controller might also disclose his email address to third parties because the controller has already used it without authorization (vis-à-vis the data subject). However the court held that only those further infringements could, if they occur, give rise to independent claims for damages. Regarding the the controller’s failure to respond to the data subject’s email objecting to the sending of the emails, the court held, that this might at most exacerbate any existing non-material damage, but it does not establish it in the first place.

### GP v juris GmbH

*Source: Court of Justice of the European Union, C-741/21, 2024-04-11 — https://overview.legal/posts/132262 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0741*

In Case C-741/21, the Court of Justice of the European Union (Third Chamber) addressed a preliminary reference from the Landgericht Saarbrücken in proceedings between data subject GP and juris GmbH concerning GP's claim for compensation under Article 82 GDPR after the company processed his personal data for marketing purposes despite his objections. The Court held that "non-material damage" under Article 82(1) GDPR must be interpreted broadly and is not subject to a seriousness threshold, that a controller may be exempt from liability under Article 82(3) if it proves it was not in any way responsible for the infringement (including where a person acting under its authority under Article 29 was at fault), and that the criteria for administrative fines under Article 83 GDPR do not apply to the assessment of compensation amounts.

### A v Patērētāju tiesību aizsardzības centrs

*Source: Court of Justice of the European Union, C-507/23, 2024-10-04 — https://overview.legal/posts/132162 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0507*

The Court of Justice of the European Union issued a preliminary ruling on a reference from the Latvian Supreme Court in Case C-507/23, involving an individual ("A") and the Patērētāju tiesību aizsardzības centrs (Consumer Rights Protection Centre, Latvia) regarding compensation for non-material damage allegedly suffered from unlawful processing of personal data under Article 82(1) GDPR. The Court addressed whether apologies can constitute compensation for non-material damage and whether the controller's attitude and motivation may be considered in assessing the form and level of compensation. No fine was imposed, as the ruling clarifies interpretive questions of EU law for the referring national court.

### JU and SO v Scalable Capital GmbH

*Source: Court of Justice of the European Union, C-182/22, 2024-06-20 — https://overview.legal/posts/132254 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0182*

In Joined Cases C-182/22 and C-189/22, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Amtsgericht München concerning the interpretation of Article 82 GDPR in proceedings brought by data subjects JU and SO against Scalable Capital GmbH following the theft of their personal data from the company's trading application. The core issue was whether Article 82 GDPR permits compensation for non-material damage that is minimal or symbolic, and whether such compensation can serve a punitive function. The Court held that Article 82 GDPR does not preclude the awarding of minimal compensation for non-material damage, such as distress following a personal data breach, provided the damage is genuine and actually arose from the infringement, but clarified that compensation under the GDPR must be purely reparative and cannot have a punitive character.

### BL v MediaMarktSaturn Hagen-Iserlohn GmbH

*Source: Court of Justice of the European Union, C-687/21, 2024-01-25 — https://overview.legal/posts/132272 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0687*

In Case C-687/21, the Court of Justice of the European Union interpreted Articles 5, 24, 32, and 82 of the GDPR in response to a preliminary ruling request from the Amtsgericht Hagen in proceedings between data subject BL and MediaMarktSaturn Hagen-Iserlohn GmbH concerning alleged non-material damage from personal data transmitted to an unauthorized third party due to employee error. The Court held that a controller's infringement of GDPR security obligations through employee error can give rise to a right to compensation under Article 82, that the severity of the infringement may be relevant to assessing both the appropriateness of protective measures and the existence of damage, and that the concept of non-material damage should be interpreted broadly without requiring a minimum threshold of severity. No fine was imposed, as the ruling addresses interpretation of GDPR provisions rather than administrative penalties.

### SO Warszawa - III C 904/23

*Source: Regional Court in Warsaw, 2026-02-16 — https://overview.legal/posts/53100 — original: https://gdprhub.eu/index.php?title=SO_Warszawa_-_III_C_904/23*

Facts — The Financial Ombudsman’s office (the controller) sent a letter containing the name, the address, and the case reference number of a customer (the data subject) to 28,366 public institutions and entities registered on an official government platform in February 2021. The data subject demanded compensation for the unauthorised disclosure of his personal data from the controller in November 2021. The controller refused to accept liability for the incident. The supervisory authority issued the controller a reprimand in September 2022 for disclosure of personal data in violation of Article 6(1) GDPR. The data subject brought a lawsuit for damages under Article 82 GDPR before the Regional Court in Warsaw in August 2023. The data subject stated that they had experienced severe stress and lost the sense of security and control over their data as a result of the unauthorised disclosure of the letter. The controller argued it was not at fault for the incident as it was caused by a temporary IT system failure that the controller could not have foreseen. Holding — The Regional Court in Warsaw held that the controller was undoubtedly liable for the unauthorised disclosure of the data subject’s personal data pursuant to Article 82 GDPR: the controller was an administrator for the government platform and had not taken adequate measures to secure the data. Second, the court held that the data subject had suffered non-material damage in connection with the aforementioned incident. It took into account that the data had been disclosed to numerous entities. In addition, the deterioration of the data subject’s mental state was confirmed by a witness. The court awarded the data subject PLN 40,000 in damages. It considered the data subject’s claim of PLN 50,000 to be excessive in light of established case law.

### AT and BT v PS GbR and Others

*Source: Court of Justice of the European Union, C-590/22, 2024-06-20 — https://overview.legal/posts/132253 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0590*

In Case C-590/22, the Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from the Amtsgericht Wesel (Germany) in proceedings between individuals AT and BT and tax consultancy PS GbR, concerning whether the claimants could receive compensation under Article 82(1) GDPR for non-material damage (fear and suffering) after their tax return was disclosed to third parties without consent. The Court held that the concept of non-material damage must be interpreted broadly and that compensation under Article 82 does not require the damage to reach a certain threshold of seriousness, nor can the criteria for administrative fines under Article 83 be applied to compensation claims, though the amount of compensation must correspond to the actual harm suffered.

### VX and AT v Gemeinde Ummendorf

*Source: Court of Justice of the European Union, C-456/22, 2023-12-14 — https://overview.legal/posts/132277 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0456*

In Case C-456/22, the Court of Justice of the European Union (Third Chamber) addressed a preliminary ruling from the Landgericht Ravensburg concerning whether Article 82(1) of the GDPR permits a national "de minimis threshold" for establishing non-material damage. The underlying dispute involved two individuals, VX and AT, seeking compensation from the Gemeinde Ummendorf for the municipality's unauthorized online publication of their personal data, including names and an address, in a municipal council meeting agenda. The Court held that Article 82(1) of the GDPR precludes national legislation or practice requiring a de minimis threshold of noticeable disadvantage or objectively comprehensible impairment for non-material damage claims, clarifying that the mere loss of control over personal data may itself constitute non-material damage warranting compensation.

### LAG Köln - 6 SLa 116/26

*Source: Cologne Higher Labour Court, 2026-06-25 — https://overview.legal/posts/353955 — original: https://gdprhub.eu/index.php?title=LAG_Köln_-_6_SLa_116/26*

Facts — The data subject had applied for a secretary position in a human resources consulting company (the controller) in January 2025. He later filed a lawsuit claiming he had been discriminated against in the recruitment process on the basis of his gender and his disability. In October 2025, the data subject amended his lawsuit to include a claim for non-material damages of at least €1,000 under Article 82 GDPR. He claimed to have lost the control of his personal data as the controller had submitted a screenshot of the data subject’s Facebook profile to the court as an attachment to its answer to the lawsuit without first informing him of the collection and processing of his data in accordance with Article 14 GDPR. The court of first instance issued a default judgment where it dismissed the damages claim on 14 October 2025, as the data subject failed to appear before the court. This outcome was upheld in a final decision in January 2026: the court of first instance held that the data subject had voluntarily made the personal data at issue available for viewing by an unlimited number of people on his Facebook profile. Therefore, he had not suffered a significant loss of control over his personal data. The data subject appealed this decision to the Cologne Higher Labour Court in February 2026. Holding — The higher labour court dismissed the data subject’s claim for damages under Article 82 GDPR. First, the court held that the controller had not fully complied with its obligations under Article 14 GDPR – it had not provided the data subject the contact information of its data protection officer, specified the categories of personal data being processed, or explicitly identified the legitimate interests pursued. While the court found that there had been a violation of Article 14 GDPR, it also pointed out that a GDPR infringement alone could not give rise to a claim for damages. According to the court, the data subject had not suffered non-pecuniary damage in the present case. He had not lost control over his personal data or been reduced to a mere object of data collection, as he had made a voluntary decision to make the personal data at issue publicly available by setting this information to “public” on his own Facebook profile. The court held that this was not comparable to a Google search, where information that the data subject themselves has not chosen to publish could also have been made available by third parties.

### BGH - VI ZR 97/22

*Source: Federal Court of Justice, 2026-06-23 — https://overview.legal/posts/184554 — original: https://gdprhub.eu/index.php?title=BGH_-_VI_ZR_97/22*

Facts — An employee of a private bank (the controller) erroneously sent a third party a message that was intended for a candidate in the controller’s staff selection process (the data subject) in October 2018. The message contained the data subject’s full name and information about their salary expectations. After the data subject was informed they were no longer considered for the position, they brought court proceedings requesting injunctive relief in order to prohibit the controller from processing the data subject’s personal data in connection with their job application. In addition, the data subject claimed non-material damages. The court of first instance granted the injunction and awarded the data subject € 1,000 in damages. The appellate court upheld the injunction but rejected the damages claim. The Federal Court of Justice (BGH) referred several questions to the CJEU regarding the interpretation of Article 82 GDPR. The CJEU rendered its judgment in the case C-655/23 Quirin Privatbank in September 2025. It held that Member States may provide for injunctive relief in national law in cases of unlawful processing. According to the CJEU, negative feelings caused by a loss of control over personal data can also constitute non-pecuniary damages. Holding — First, the Federal Court of Justice held that the data subject was entitled to non-material damages in accordance with Article 82 GDPR. The court confirmed the appellate court had correctly found that sending the message containing personal data to a third party had been unlawful due to the lack of a legal basis under Article 6(1) GDPR – the data subject had not consented to the processing. Furthermore, the controller had not argued that the processing would have been lawful under a different legal basis. The court also confirmed that the data subject had suffered non-material damage as a result of this GDPR violation. In the present case, the data subject’s concern that the recipient of the message might use the personal data contained in it for their own job applications already constituted loss of control of the data subject’s personal data and was therefore enough to establish a claim for damages under Article 82 GDPR. The court referred the case back to the appellate court so that it could determine the amount of non-material damages. Finally, the court held that the appellate court had erroneously upheld the data subject’s claim for injunctive relief: there was no risk of recurrence required for such a claim in German law. As the staff selection process in which the data subject had participated had already been completed, there was no likelihood whatsoever that such an infringement of the data subject’s rights would recur.

### Marián Kočner v European Union Agency for Law Enforcement Cooperation (Europol)

*Source: Court of Justice of the European Union, C-755/21, 2024-03-05 — https://overview.legal/posts/132271 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0755*

In Case C-755/21 P, Marián Kočner appealed a General Court judgment dismissing his claim for compensation against Europol for alleged damage arising from Europol's disclosure of his personal data and inclusion of his name on so-called "mafia lists." The Grand Chamber of the Court of Justice of the European Union examined the scope of non-contractual liability under Articles 49(3) and 50 of Regulation (EU) 2016/794, addressing whether Europol could be held liable for non-material damage resulting from unlawful data processing. The full outcome of the appeal is not reflected in the provided excerpt, which does not include the operative part of the judgment.

### CJEU - C‑755/21 P - Kočner v Europol

*Source: Court of Justice of the European Union, 2024-03-05 — https://overview.legal/posts/122879 — original: https://gdprhub.eu/index.php?title=CJEU_-_C‑755/21_P_-_Kočner_v_Europol*

Facts — Following the murder of a Slovak journalist and his fiancée, Mr Ján Kuciak and Ms Martina Kušnírová, in Slovakia on 21 February 2018, the Slovak authorities (Národná kriminálna agentúra (National Crime Agency, Slovakia; ‘NAKA’)) conducted an extensive investigation. At the request of those authorities, the European Union Agency for Law Enforcement Cooperation (‘Europol’) extracted the data stored on two mobile telephones allegedly belonging to Mr Marian Kočner, the data subject, who was prosecuted as an accomplice to that murder for having ordered the killings, following the investigation. Europol sent its scientific reports to those authorities and delivered to them a hard disk containing the encrypted data it had extracted. In one of its reports, Europol stated that Mr Kočner had been detained on suspicion of a financial offence since 2018 and that his name was, inter alia, directly linked to the ‘so-called mafia lists’ and the ‘Panama Papers’. In May 2019, the Slovak press and international network of investigative journalists published a large amount of information relating to Mr Kočner from his mobile telephones, including transcripts of intimate communications exchanged between him and his girlfriend. The conversation was carried by means of encrypted messaging service. For the reasons stated above, Mr Kočner sent a complaint to Europol seeking compensation in the amount of €100,000 as a reparation for the non-material damage on the bases of Article 50(1) Regulation 2016/794. The sought compensation consisted of €50,000 for the unlawful disclosure of data subject's intimate conversation with his girlfriend and €50,000 for the inclusion of his name on the 'mafia list'. Europol and Slovak Republic contended that the arguments are unfounded as, firstly, Regulation 2016/794 (setting up the rules for the Europol) does not provide for such joint liability of Europol and the Member State. Secondly, Europol rejects any liability due to the absence of unlawful conduct on its part given that alleged harmful events occurred during storage of the national investigation file. As such, these circumstances do not constitute ‘unlawful data processing operations’ within the meaning of Article 50(1) Regulation 2016/794. Lastly, Europol stated that even if joint liability was applicable, the absence of any unlawful conduct on its part and of a causal link between such conduct and the damage suffered could not give rise to a liability. Holding — Firstly, the CJEU ruled that there is no need to establish additionally to which of these two entities - Europol or the Member State - that unlawful processing was attributable. In order for such joint and several liability to be incurred in the first stage, the individual concerned must show only that, in the course of cooperation between Europol and the Member State concerned, unlawful data processing that caused him or her to suffer damage has been carried out. Secondly, concerning specifically the leak of the 'so-called mafia list', the CJEU found that the data subject had failed to establish that the ‘mafia lists’ on which his name had allegedly been included had been drawn up and kept by Europol. The data subject's claim contradicted the evidence whereby it was apparent that the leaked Europol report containing Mr Kočner’s name on the ‘mafia list’ was subsequent to and, thus, unrelated to Slovak press publications where he was represented as ‘member of the mafia’. Thirdly, the CJEU rejected the Europol’s argument that it met its obligations and implemented appropriate technical and organizational measures to protect personal data against any form of unauthorized access. The Court observed that the data of such intimate nature bears out the need for its protection to be strictly ensured in cooperation with Member States under Regulation 2016/794. As an unauthorized access took place it constituted a sufficiently serious breach of a rule of EU law intended to confer rights on individuals. Fourthly, the Court held that European Union can incur non-contractual liability in the present case, as the result of publication of data subject’s intimate conversations. The leak of this information adversely affected his honour and professional reputation, and violated his rights to privacy, family life and respect for his communications guaranteed by Article 7 of the Charter of Fundamental Rights of the European Union. As a result, the CJEU held Europol and the Slovak Republic jointly and severally liable for the unlawful data processing which caused the data subject to suffer non-material damage. The Court stated that Europol has the possibility to refer the matter to its Management Board so that it can determine who has the ultimate responsibility for the compensation awarded to the data subject. However, this exclusively concerns the internal allocation of responsibilities between the two jointly liable controllers. The compensation attributed to the data subject for the inclusion of his name on the ‘mafia list’ by Europol was firstly set at €50,000. As this claim was dismissed, the Court only examined the damage regarding the compensation of €50,000 for disclosure of the data subject’s conversation with his girlfriend. The Court decided that the alleged damage resulted solely from the disclosure of transcripts of the conversation and no evidence established that any photographs have been disclosed. As a result, the CJEU granted Mr Kočner compensation in the amount of €2,000 as reparation for that damage.

## Guidance

### Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)

*Source: EDPB, opinion-222024-on-certain-obligations-following-from-the-en, 2024-10-09 — https://overview.legal/posts/125715 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-222024-on-certain-obligations-following-from-the_en*

A dopted 1 Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub - processor(s) Adopted on 7 October 2024 Adopted 2 Executive summary The Danish SA requested the EDPB to issue an opinion on matters of general application pursuant to Article 64(2) GDPR. The opinion contributes to a harmonised interpretation by the national supervisory authorities of certain aspects of Article 28 GDPR, whe re appropriate in conjunction with Chapter V GDPR. In particular, the…

### Guidelines 9/2022 on personal data breach notification under GDPR

*Source: EDPB, edpb-guidelines-on-personal-data-breach-notification-under-gdpr, 2023-04-04 — https://overview.legal/posts/38058 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-92022-on-personal-data-breach-notification-under-gdpr_en*

The EDPB adopted Guidelines 9/2022 (Version 2.0, 28 March 2023) to update and replace the prior WP250 guidance on personal data breach notification under Articles 33 and 34 of the GDPR. The guidelines address the definition and types of personal data breaches, controller and processor notification obligations, the concept of a controller becoming "aware" of a breach, cross-border and non-EU establishment breach scenarios, and the conditions under which notification to supervisory authorities and data subjects is or is not required.

### Guidelines 04/2022 on the calculation of administrative fines under the GDPR

*Source: EDPB, edpb-guidelines-on-the-calculation-of-administrative-fines-under-the-gdpr, 2023-05-24 — https://overview.legal/posts/38068 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-042022-on-the-calculation-of-administrative-fines-under-the-gdpr_en*

The European Data Protection Board (EDPB) has adopted these guidelines to harmonise the methodology supervisory  authorities use  when calculating of the amount of the fine. These Guidelines complement the previously  adopted Guidelines on the application and setting of administrative fines  for the purpose  of the Regulation 2016/679 (WP253), which focus on the circumstances in which to impose a fine. The calculation of the amount of the fine is at the discretion of the supervisory  authority, ...

### Guidelines 07/2020 on the concepts of controller and processor in the GDPR

*Source: EDPB, edpb-guidelines-on-the-concepts-of-controller-and-processor-in-the-gdpr, 2021-07-07 — https://overview.legal/posts/38069 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-072020-on-the-concepts-of-controller-and-processor-in-the-gdpr_en*

The concepts of controller, joint controller and processor play a crucial role in the application of the General Data Protection Regulation 2016/679 (GDPR), since they determine who shall be responsible for compliance with different data protection rules, and how data subjects can exercise their rights in practice. The precise meaning of these concepts and the criteria for their correct interpretation must be sufficiently clear and consistent throughout the European Economic Area (EEA). The conc...

### Guidelines 4/2019 on Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020

*Source: EDPB, edpb-guidelines-on-data-protection-by-design-and-by-default, 2020-10-20 — https://overview.legal/posts/38054 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-42019-on-article-25-data-protection-by-design-and-by-default_en*

The European Data Protection Board (EDPB) adopted these guidelines (Version 2.0) to provide interpretive guidance on Article 25 of the GDPR, which mandates data protection by design and by default. The guidelines address controllers' obligations to implement appropriate technical and organizational measures and necessary safeguards into processing operations, including the dimensions of data minimization required by default. No fines or enforcement actions are at issue, as this is a guidance document intended to assist controllers in complying with their Article 25 obligations.

### Guidelines 8/2020 on the targeting of social media users

*Source: EDPB, edpb-guidelines-on-the-targeting-of-social-media-users, 2021-04-13 — https://overview.legal/posts/38073 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-82020-on-the-targeting-of-social-media-users_en*

The EDPB adopted Guidelines 8/2020 on the targeting of social media users to clarify the roles, responsibilities, and legal obligations of the various actors involved in social media targeting, including social media providers, targeters, and users. The guidelines analyze different targeting mechanisms—based on provided, observed, and inferred data—and address controller determinations, legal bases, transparency requirements, DPIAs, and the processing of special categories of data. No fines are imposed, as this is interpretive guidance intended to assist stakeholders in achieving GDPR compliance.

### Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them

*Source: EDPB, edpb-guidelines-on-deceptive-design-patterns-in-social-media-platform-interfaces-how-to-recognise, 2023-02-24 — https://overview.legal/posts/38056 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-032022-on-deceptive-design-patterns-in-social-media-platform_en*

These Guidelines offer practical recommendations to social media providers as controllers of social media, designers and users of social media platforms on how to assess and avoid so-called 'deceptive design patterns' in social media interfaces that infringe on GDPR requirements. To this end, the EDPB recommends  that  controllers  make  use  of  interdisciplinary  teams,  consisting,  among  others,  of designers,  data  protection  officers  and  decision-makers.  It  is  important  to  note  ...

### Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation

*Source: EDPB, edpb-opinion-202507-epo-adequacydecision-en, 2025-05-06 — https://overview.legal/posts/50823 — original: https://www.edpb.europa.eu/documents/adequacy/opinion-072025-regarding-the-european-commission-draft-implementing-decision_en*

EDPB, Opinion 07/2025 regarding the European Commission Draft Implementing Decision pursuant to Regulation (EU) 2016/679 on the adequate protection of personal data by the European Patent Organisation, 2025.

## Enforcement decisions

### UODO (Poland) - DKN.5131.27.2023

*Source: UODO (Poland), 2026-05-19 — https://overview.legal/posts/83471 — original: https://gdprhub.eu/index.php?title=UODO_(Poland)_-_DKN.5131.27.2023*

Facts — A municipal social welfare unit (the controller) processed the personal data of the residents of the municipality (the data subjects), including names, addresses, and information regarding whether certain individuals were subject to mandatory quarantine to prevent and combat the SARS-COV-2 virus. An employee of the controller posted a file containing this information on a private server in November 2020. An automated search engine indexing bot subsequently accessed the file and made its full contents available in search results to any Internet user. The supervisory authority received an electronic report concerning a potential data breach in February 2021. The controller had not notified the DPA or the data subjects of this incident, as it concluded it had not acted as a controller in the context of the processing operations at issue. The DPA launched an investigation into the unauthorised disclosure of personal data and initiated administrative proceedings against the controller in August 2023. Holding — The DPA issued the controller three separate fines amounting to PLN 33,700 (€7,800) in total, as it considered its GDPR violations were the result of three separate courses of conduct. It held that the social welfare unit had clearly determined the means and purposes of processing and acted as controller within the meaning of Article 4(7) GDPR – the employee responsible for the processing operations had acted with the unit’s authorisation, at its instruction, and on its behalf. First, the DPA held the controller had violated Articles 24(1), 25(1), 32(1), and 32(2) GDPR by failing to implement appropriate technical and organisational measures and imposed a fine of PLN 15,000 (€3,460) on the controller. This resulted in violations of the principles of integrity, confidentiality and accountability set out in Articles 5(1)(f) and 5(2) GDPR. There was an internal document in effect during the data breach that identified the risk level of processing as high. However, the DPA pointed out this document did not include, among other things, the number of data subjects, the periods for data storage, and the duration of the processing. The measures implemented were not reviewed or updated and also proved to be ineffective. Second, the DPA issued the controller a fine of PLN 5,500 (€1,270) for an infringement of Article 33(1) GDPR due to a failure to report the data breach to the supervisory authority. Finally, the DPA held that the controller had violated Article 34(1) GDPR by failing to notify the data subjects of the data breach and imposed a fine of PLN 13,200 (€3,060) on the controller. In addition, it ordered the controller to notify the data subjects of the breach in question.

### EDPB - Binding Decision 1/2026

*Source: EDPB, 2026-05-28 — https://overview.legal/posts/144037 — original: https://gdprhub.eu/index.php?title=EDPB_-_Binding_Decision_1/2026*

Facts — On 10 August 2021, a data subject represented by noyb lodged a complaint with the Austrian DPA against Vlaamse Radio- en Televisieomroeporganisatie (VRT), the controller. The complaint concerned the controller’s cookie banner and alleged infringements of Articles 5(1)(a), 6(1)(a), 12(1), 12(2) and 13(1)(c) GDPR, as well as Article 5(3) ePrivacy Directive. It formed part of a wider project involving similar cookie banner complaints submitted by noyb across the EEA. The Austrian DPA transferred the complaint to the Belgian DPA, which acted as the lead supervisory authority. In its draft decision, the DPA proposed dismissing the complaint without examining its merits. It considered that the data subject and noyb had abused the rights provided under Articles 77 and 80(1) GDPR. The DPA relied on factors including the standardised and partly automated preparation of the complaints, noyb’s role in selecting the targeted controllers, the relationship between the data subject and noyb, and the broader strategic objectives pursued by the organisation. It considered that both the objective and subjective elements required to establish an abuse of rights were present. The Austrian DPA raised a relevant and reasoned objection under Article 60(4) GDPR. It argued that the circumstances did not demonstrate an abuse of rights and requested that the complaint be examined on its merits in accordance with Article 57(1)(f) GDPR. As the DPA did not follow the objection, it referred the dispute to the EDPB under Article 65(1)(a) GDPR. Holding — The EDPB first held that it was competent to decide the dispute. Its powers under Article 65(1)(a) GDPR are not limited to determining whether a controller infringed the GDPR. They also cover disputes concerning whether an action envisaged by a supervisory authority, including the dismissal of a complaint, complies with the GDPR. The EDPB found that the Austrian DPA’s objection met the requirements of Article 4(24) GDPR. The objection was directly connected to the draft decision, proposed a different outcome and sufficiently demonstrated the risks that the dismissal would create for data subjects’ rights and the consistent application of the GDPR. On the merits, the EDPB recalled that the prohibition of abuse of rights must be interpreted strictly, particularly where its application may restrict the fundamental right to data protection and the rights provided by Articles 77 and 80(1) GDPR. The supervisory authority alleging abuse bears the burden of establishing both its objective and subjective elements on the basis of sufficient evidence. Regarding the objective element, the EDPB acknowledged that noyb had organised a project involving predefined selection criteria, standardised complaints and automated tools. However, the data subject had validly mandated noyb under Article 80(1) GDPR and had lodged a complaint concerning an alleged infringement of their own data protection rights. Consequently, the objectives of Articles 77 and 80(1) GDPR had been fulfilled rather than circumvented. Regarding the subjective element, the EDPB found no evidence that the complaint had been submitted to obtain an undue advantage unrelated to the purposes of the GDPR. The objectives pursued by noyb could not be separated from those of the data subject merely because the organisation had played a leading role in preparing the complaint. Nor was there evidence that the data subject or noyb had sought compensation or another financial benefit. The EDPB therefore concluded that the data subject had not abused the right to lodge a complaint under Article 77 GDPR or the right to be represented under Article 80(1) GDPR. It instructed the DPA not to dismiss the complaint on that basis, to assess it on its merits and to submit a new draft decision to the supervisory authorities concerned under Article 60(3) GDPR.

### APD/GBA (Belgium) - 159/2023

*Source: APD/GBA (Belgium), 2023-11-24 — https://overview.legal/posts/122845 — original: https://gdprhub.eu/index.php?title=APD/GBA_(Belgium)_-_159/2023*

Facts — On 19 July 2023, a data subject, represented by noyb (European Centre for Digital Rights), filed a complaint against Mediafin, a Belgian media group, with the Belgian DPA. The complaint concerned the practices of the setting of cookies on the website of the Belgian newspaper De Tijd, owned by Mediafin (the controller). The data subject first complained about a missing "decline" option next to the "consent" option at the first level of the cookie banner. Second, it stated that the cookie banner used misleading button colours and third, that it was not as easy to withdraw consent as it was to give it. On 20 October 2023, a settlement proposal was sent to the parties. The data subject responded on 30 October 2023 demanding a few modifications to the proposed settlement, which the DPA denied on 6 November 2023. Meanwhile, the controller accepted the proposal on 24 November 2023. Holding — In its settlement decision, the Belgian DPA held that the controller should comply with three conditions. Firstly, the DPA stated that the controller should provide the cookie-setting banner on De Tijd with a "refuse all" option at the same level as the "agree and close" option within one month of the decision. Secondly, it pointed out that the "refuse all" option should be displayed no less (visually) attractive than the "agree and close" option. The data subject requested to modify this condition. Instead, it requested that both options be identical in size, colour, shape, contrast and location. This demand was, however, rejected. The DPA stated that the controller was free to display the "refuse all" option in an even more appealing manner than the "agree and close" option. Lastly, the DPA noted that the controller should, within one month of the decision, ensure that it does not take more clicks to withdraw than to give consent on the website in question. The clicks should be counted from the moment the data subject reaches the cookie setting page, and this page should be accessible on every page of the litigious website. The DPA mentioned that this change should be done to meet the requirements of collecting valid consent under the GDPR and Article 5(3) ePrivacy Directive 2002/58/EC, as well as the following three additional cumulative requirements: (i) the ability to withdraw consent, (ii) the ability to withdraw consent at any time and (iii) withdrawal of consent must be as easy as giving consent. The DPA decided to not impose a fine because it did not feel the need for a sanction.

### AEPD sanctions Vodafone España for inadequate Super WiFi processor agreement and oversight

*Source: AEPD (Spain), 2026-09-23 — https://overview.legal/posts/354173 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_PS-00240-2025*

Facts — Vodafone España, S.A.U., the controller, operated a service known as "Super WiFi" through a third-party processor. Following a data breach affecting the service, the DPA's investigation found that personal data processed on behalf of the controller had been accessed without authorisation. The processor provided software services related to the Super WiFi service and processed and stored personal data of the controller's customers. The processor informed the controller of the security incident on 20 November 2023, and the controller notified the DPA of the personal data breach on 23 November 2023. The controller submitted a processing agreement which stated that it had entered into force in December 2022. However, the agreement was only formally signed in September 2024, after the data breach had occurred. The controller argued that the agreement had already been binding before its signature and that the absence of a signature did not mean that no contract existed. The controller also relied on two documents dated 22 December 2022 and 30 March 2023 to demonstrate that it had carried out audit and control activities concerning the processor. Neither document was signed and the DPA considered that they did not sufficiently demonstrate how the processor's security measures had actually been verified. The controller also claimed that encryption measures had been imposed on the processor. However, the only reference to this measure in the file appeared in the controller's initial written reply to the DPA inspector, unsupported by documentation, and the information available to the DPA indicated that the affected data were accessible in unencrypted form. The documents relied on by the controller referred to pseudonymisation but did not establish that encryption had been implemented. The controller raised several objections during the procedure. It argued in particular that a valid processing agreement already existed when the processing took place, that it had implemented adequate security and oversight measures, and that the previous sanctions should not be taken into account as an aggravating factor. Holding — The DPA rejected the controller's arguments. First, regarding Article 28 GDPR, the DPA held that a processor must be bound by a written contract or other legal act from the moment it begins processing personal data on behalf of the controller. Although the agreement submitted by the controller referred to an effective date in December 2022, it was not formally signed until September 2024. The DPA considered that giving the agreement retroactive effect could not remedy the period during which processing had already taken place without a formally perfected agreement. Therefore, the controller infringed Article 28 GDPR. The DPA stressed that allowing agreements concluded after processing had begun to operate retroactively would undermine the purpose of Article 28 GDPR. The processor must be formally subject to the controller's instructions and to the safeguards required by the GDPR throughout the processing relationship, rather than having those safeguards formalised ex post. Second, the DPA found an infringement of Article 32 GDPR. It considered that the technical and organisational measures implemented in relation to the processor were insufficient. In particular, the controller had not adequately demonstrated that relevant security measures were actually implemented and had relied substantially on information supplied by the processor without sufficiently verifying its effectiveness. The audit documents submitted by the controller did not explain the methodology used or demonstrate effective verification of the measures in practice. The DPA also rejected the controller's reliance on encryption. The available documentation did not demonstrate that the affected personal data were encrypted, and documents concerning cryptography referred to pseudonymisation rather than encryption. Third, the DPA held that the insufficient security measures resulted in a loss of confidentiality of personal data and therefore also constituted an infringement of Article 5(1)(f) GDPR. The DPA also considered two previous decisions against the controller, PS/00538/2021 and PS/00164/2022, as aggravating factors under Article 83(2)(e) GDPR. Both concerned infringements of Articles 5(1)(f) and 32 GDPR, and the controller had acknowledged its responsibility in both proceedings. When determining the fines, the DPA took into account, among other factors, the nature and gravity of the infringements and the controller's degree of responsibility. It also considered the controller's habitual processing of large volumes of personal data as an aggravating factor under Article 76(2)(b) LOPDGDD. The DPA imposed three administrative fines: €500,000 for the infringement of Article 5(1)(f) GDPR, €150,000 for the infringement of Article 32 GDPR and €100,000 for the infringement of Article 28 GDPR. The total fine therefore amounted to €750,000. No additional corrective measure was imposed.

### AEPD fines DIGI Telecom for issuing duplicate SIM to impersonator without consent

*Source: AEPD (Spain), 2026-09-16 — https://overview.legal/posts/109001 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_EXP202310345*

Facts — On December 28, 2022, DIGI Telecom, the controller, delivered a duplicate SIM card to an unauthorized third party without the consent of the original line holder (the data subject) The duplicate SIM card was delivered to an impersonator after they passed the established protocols for verifying the applicant's identity. The controller appealed the decision by the Spanish DPA to impose a fine because they claimed that they had appropriate security measures. The controller claims that, by focusing on the result, the Spanish DPA is acting under strict liability. The mere fact that identity theft occurred does not equal a lack of due diligence on the part of the controller. The controller also requested a reduction of the fine on the basis of Article 83(5)(a) GDPR because there were no aggravating circumstances and no special categories of data were processed Holding — The Spanish DPA found a violation of Article 6(1) GDPR because issuing a duplicate SIM card and delivering it to a person other than the telephone line holder constitutes the processing of personal data within the meaning of Article 4(1) GDPR without a legal basis because the data subject did not give consent. The DPA ruled that the controller violated their duty of care because the security measures lacked the dilligence required. According to Article 5(2) GDPR (principle of proactive responsibility) the controller must demonstrate compliance to the GDPR. Proactive responsibility means that the measures are compliant to the GDPR under normal circumstances. The controller must also demonstrate that the measures are compliant with the GDPR and that they are effective in the specific context and purposes of processing (Article 24 en 25 GDPR). The controller had a higher standard of care because of a documented risk to SIM swap attacks and the high scale of processing. Recital 74 GDPR states that the controller’s must implement effective and appropriate measures that take into account the nature, scope and context, and purposes of processing. The card allows an impersonator to access additional data through which they can carry out actions with grave consequences. The controller did not demonstrate that their security measures sufficiently protected the data subject. Factual circumstances should have alerted DIGI to the fraud: the SIM card replacement was processed at a physical store in a different province from where the data subject resided. The Spanish DPA flagged that the controller did not ask the reason for issuing the card and they did not verify whether the old SIM card was functioning. Therefore the security measures were not appropriate to prevent'SIM swap attacks' that are prevalent in the telecom context. With regard to to the height of the fine, the Spanish DPA found that no new legal arguments were made that would lead to the reduction of the fine.

### Permanent TSB: Insufficient technical and organisational measures to ensure information security

*Source: Data Protection Authority of Ireland, 2026-05-08 — https://overview.legal/posts/53597 — original: https://www.enforcementtracker.com/ETid-3146*

Data Protection Authority of Ireland fined Permanent TSB €277,500 on 2026-05-08 for: Insufficient technical and organisational measures to ensure information security.

### AEPD (Spain) - EXP202306354 (PS/00312/2024)

*Source: AEPD (Spain), 2026-02-11 — https://overview.legal/posts/52464 — original: https://gdprhub.eu/index.php?title=AEPD_(Spain)_-_EXP202306354_(PS/00312/2024)*

Facts — The Spanish Data Protection Agency (AEPD) investigated Vodafone España, S.A.U. as controller after a SIM swapping incident. On 21 September 2021, an unknown third party requested a duplicate SIM card for the mobile line of a data subject. The request was made through Vodafone’s internal telephone support channel for retail stores. The caller impersonated staff and provided several data elements, including the store user code, the data subject’s identification number, the mobile phone number and digits of the ICC number of the new SIM card. Vodafone processed the request and activated the duplicate SIM card. On the same day, the data subject’s phone stopped working. Shortly afterwards, four unauthorised transactions totalling €1,996 were carried out from their bank account. The data subject contacted Vodafone, their bank and the police. Vodafone confirmed that a duplicate SIM card had been issued through a physical point of sale. After the data subject presented a complaint, during the investigation, Vodafone explained that its internal policy required store staff to call a dedicated support channel and provide identifying information before a duplicate SIM could be issued. Vodafone stated that the fraudster had provided the required information and that the security protocol in force at the time had been followed. The controller also informed the AEPD that it later adopted additional measures to reinforce the security of the duplicate SIM procedure. On the basis of these facts, the AEPD opened sanctioning proceedings against Vodafone for an alleged infringement of Article 6(1) GDPR. Holding — The AEPD found that Vodafone infringed Article 6(1) GDPR by processing the personal data of the data subject without a valid legal basis. The AEPD held that the issuance and activation of a duplicate SIM card involved the processing of personal data. Vodafone carried out this processing without the knowledge or consent of the data subject and without any other legal basis under Article 6(1) GDPR. As a result, the processing was unlawful. The AEPD rejected the controller’s argument that it had complied with its internal security protocols. The DPA stated that the existence of internal procedures did not remove the obligation to ensure that processing had a valid legal basis. The intervention of a criminal third party did not exempt the controller from responsibility where the unlawful processing occurred within its own systems and procedures. The AEPD considered that Vodafone acted at least negligently. It took into account the nature of the infringement and the link between the processing and the controller’s core business activity. The DPA imposed an administrative fine of €150,000 on Vodafone for the infringement of Article 6(1) GDPR.

### VDAI fines medical company €450,000 for inadequate security measures in data breaches

*Source: VDAI (Lithuania), 2026-06-19 — https://overview.legal/posts/53896 — original: https://gdprhub.eu/index.php?title=VDAI_(Lithuania)_-_3R-1143*

Facts — Two medical companies (the controllers) had fallen victim to data breaches where a third party had gained access to their internal systems containing both health data and other personal data of patients (the data subjects). The first breach potentially concerned 63 data subjects, whereas the latter breach affected approximately 10,000 employees and 383,000 data subjects. The DPA initiated two separate investigations against the controllers in September 2024 and November 2025 respectively and later combined the cases. Holding — The DPA imposed a fine of €450,000 on the first controller it investigated as this company was also the legal successor of the other controller. It held that the controllers had failed to implement appropriate technical and organisational measures to ensure the security of processing and compliance with the principles of integrity and confidentiality. The controller had violated Articles 5(1)(f), 24(1), and 32(1)(b) GDPR. When assessing the GDPR infringements, the DPA took into account that the controllers processed sensitive categories of personal data. The DPA held the controllers lacked adequate security measures for protecting against unauthorised access to an IT system, such as access control and authentication. For instance, passwords used by employees did not reach a certain level of complexity, and multi-factor authentication was not used.

## Recent developments

### Legal Analysis: No non-material damages for GDPR violations?

*Source: noyb - European Center for Digital Rights, 2022-10-12 — https://overview.legal/posts/53264 — original: https://noyb.eu/en/analysis-no-non-material-damages-gdpr*

Legal Analysis: No non-material damages for GDPR violations (C-300/21)? By Max Schrems | Download the PDF Version of this Legal Analysis On 6 October 2022, Advocate General (AG) Sánchez-Bordona issued his Opinion on CJEU case C-300/21 (UI v. Österreichische Post AG), the first of several preliminary ruling requests on the topic of damages for GDPR violations pending with the CJEU. Relevant material: Reference by the Austrian Supreme Court (in German) Final judgment by the Austrian Supreme Court

### An analysis of Dutch case law: what factors play a role in awarding (or not) and determining the extent of damages under the GDPR?

*Source: News, 2022-11-17 — https://overview.legal/posts/6245 — original: https://www.vast-online.nl/art/4442/een-analyse-van-de-nederlandse-rechtspraak-welke-factoren-spelen-een-rol-bij-het-al-dan-niet-toekennen-en-vaststellen-van-de-omvang-van-een-schadevergoeding-op-grond-van-de-avg#entry-1349*

Since May 2018, the GDPR has been directly applicable in the European Economic Area, including the member states of the European Union, Liechtenstein, Norway, and Iceland. Four years later, awarding damages for GDPR violations is still not a common practice in the Netherlands, despite the fact that news reports regularly mention data breaches and other GDPR violations. This article analyzes Dutch case law over the past four years to see what factors may influence the awarding of damages under th

### Privacy activists warn against removing compensation for data protection breaches

*Source: EURactiv, 2022-10-13 — https://overview.legal/posts/6258 — original: https://www.euractiv.com/section/data-protection/news/privacy-activists-warn-again-removing-compensation-for-data-protection-breaches/#entry-1043*

> The Advocate General of the Court of Justice of the European Union (CJEU) issued a non-binding opinion, which privacy advocates fear could further limit users’ possibilities to enforce their privacy rights under the GDPR. 

> According to [the opinion](https://curia.europa.eu/juris/document/document.jsf;jsessionid=79F0B703F7CD84C2DE01BF340FD03C29?text=&docid=266842&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=244110) delivered last week, Europeans would hardly get compensated if t

### Privacyactivisten waarschuwen tegen het afschaffen van de compensatie voor inbreuken op de bescherming van persoonlijke gegevens.

*Source: EURactiv, 2022-10-13 — https://overview.legal/posts/51834*

De Advocaat-Generaal van het Gerechtshof van de Europese Unie (HvJEU) heeft een niet-bindend advies uitgebracht, waar privacyactivisten zich zorgen over maken, omdat dit de mogelijkheden van gebruikers om hun privacyrechten op te eisen onder de AVG (Algemene Verordening Gegevensbescherming) verder zou kunnen beperken.

Volgens het [advies](https://curia.europa.eu/juris/document/document.jsf;jsessionid=79F0B703F7CD84C2DE01BF340FD03C29?text=&docid=266842&pageIndex=0&doclang=en&mode=lst&dir=&occ=first&part=1&cid=244110), dat vorige week is uitgebracht, zouden Europeanen nauwelijks enige compensatie ontvangen als...

### The Court of Justice confirmed that there is no "threshold" for GDPR damages

*Source: noyb - European Center for Digital Rights, 2023-05-04 — https://overview.legal/posts/53241 — original: https://noyb.eu/en/court-justice-confirmed-there-no-threshold-gdpr-damages*

, contrary to national courts. Today, the Court of Justice of the European Union (CJEU) issued the first judgment on emotional damages under the GDPR, confirming that the GDPR does not require a "threshold" for damages. The other demands by the Court are the typical requirements for any damages claim. Press Release by the CJEU Judgment by the CJEU CJEU confirms "emotional damages". The CJEU has confirmed that users have a right to compensation when their personal data was illegally processed. As

## Literature

### Civil Liability for Processing of Personal Data in the GDPR

*Source: European Data Protection Law Review, 2019-01-01 — https://overview.legal/posts/132465 — original: https://doi.org/10.21552/edpl/2019/4/7*

In this paper we intend to analyse all the component paragraphs of Article 82 GDPR. The first part will be devoted to exploring the three elements of civil liability: unlawfulness, damages and causal link. The second, to the persons who can make use of this mechanism and against whom it can be invoked. And lastly, in the third part, we will address some more specific issues, in particular joint and several liability and the right of recourse. A practical standpoint is adopted, focused on problems that application of the article may raise: (i) the types of acts and omissions that permit actions to be brought to enforce liability; (ii) the types of damages which are compensable; (iii) which subjects can bring actions of this kind; and (iv) the differences between the rules established for controllers and processors. Keywords: GDPR, Civil Liability, Right to Compensation

### Latvia ∙ Compensation for Non-Material Damage in the Form of an Apology under the GDPR: Damage from a Viral Video Posted Online

*Source: European Data Protection Law Review, 2025-01-01 — https://overview.legal/posts/132582 — original: https://doi.org/10.21552/edpl/2025/3/12*

### The Court of Justice on the Excessiveness of Access Requests under the GDPR

*Source: European Journal of Risk Regulation, 2026-07-09 — https://overview.legal/posts/83502 — original: https://doi.org/10.1017/err.2026.10117*

Abstract This case note comments on the preliminary ruling of the Court of Justice of the EU in Case C-526/24 Brillen Rottler v TC of 19 March 2026, which addresses the abuse of rights under the General Data Protection Regulation (GDPR), specifically in the context of requests for access to personal data under Article 15 GDPR and compensation under Article 82 GDPR. First, the Court held that even a first access request may be regarded as “excessive” where the controller demonstrates that it was

### GDPR Implementation Series ∙ Netherlands: The GDPR Implementation Act

*Source: European Data Protection Law Review, 2018-01-01 — https://overview.legal/posts/132478 — original: https://doi.org/10.21552/edpl/2018/3/15*

### Collective Damages for GDPR Breaches: A Feasible solution for the GDPR Enforcement Deficit?

*Source: European Data Protection Law Review, 2022-01-01 — https://overview.legal/posts/132504 — original: https://doi.org/10.21552/edpl/2022/4/8*

The GDPR should have strong and effective enforcement mechanisms. However, in practice, these mechanisms are lacking, as Data Protection Authorities (DPAs) are underfunded and un-dermanned. Collective claims could be a solution. By pooling resources, individually insignifi-cant damages (scattered damages) can be claimed in an economically sensible way. To facili-tate collective claims, in December 2020 the European Union (EU) adopted a new directive con-taining a union-wide framework for collective claims. This paper explores whether collective claims are a feasible enforcement mechanism for data protection violations given the concept of damages under article 82 GDPR. So, it will be explained what types of damages can be claimed collectively. The current concept of damages under article 82 GDPR is analysed at the EU level, taking into account the principle of autonomy, case law, and literature. This will show the bound-aries within which Member States must operate when awarding damages under the GDPR. The paper explores the Dutch jurisdiction, to illustrate the interchange between EU law and Mem-ber state law. The Dutch jurisdiction is of special interest here, first, because Dutch courts have recently been applying the GDPR to award damages of up to € 2,500 per case. Second, because the Dutch framework for collective damages was renewed in 2020, which contains many simi-larities with the Collective Claim Directive. Currently, several collective GDPR claims have been filed in the Netherlands under the new framework, with a collective worth of several billion eu-ros. A 'perfect storm' is forming due to the combination of stronger collective claims frameworks and a tentative trend to award non-pecuniary GDPR damages on an individual level. GDPR non-compliance can thus lead to multi-billion claims that scale with the number of victims. Such claims can dwarf even the heftiest GDPR fines DPAs can impose. Collective GDPR claims have the potential to become a bright scenario for data subjects and daring legal entrepreneurs, and to result in a daunting future for data controllers and processors, who face scalable liability in a world of scalable business models. However, all hinges on the concept of damages.

## Related topics

- **Personal Data** — https://overview.legal/topics/personal-data
  Information relating to identified or identifiable natural persons
- **Processing** — https://overview.legal/topics/processing
  Any operation performed on personal data
- **Controllers** — https://overview.legal/topics/controllers
  Entities that determine purposes and means of processing
- **Public Authority** — https://overview.legal/topics/public-authority
  Government bodies and their data processing activities
- **Law Enforcement** — https://overview.legal/topics/law-enforcement
  Processing for law enforcement purposes
- **Supervision** — https://overview.legal/topics/supervision
  Oversight and enforcement by supervisory authorities

---
Generated by overview.legal · https://overview.legal/topics/liability · 2026-10-13