CJEU Ruling Clarifies On Liability, Damages And TOMs For Data Breaches

On 14 December 2023, the Court of Justice of the European Union (CJEU) issued a landmark ruling in the case of VB v. Natsionalna agentsia za prihodite (C‑340/21), placing a spotlight on the concept of non-material damage under Article 82 of the EU General Data Protection Regulation (GDPR) and specifically addressing the pivotal issue of the adequacy of technical and organisational measures (TOMs) in the context of a data breach.

Background

The case involved a cyber-attack against the Bulgarian National Revenue Agency, resulting in a data breach affecting over six million individuals. One affected individual sought compensation, claiming non-material damage due to the fear that their personal data, published without consent, might be misused in the future or lead to potential harm.