Employers Liable For Employees' GDPR Errors

A recent judgment of the European Court of Justice (ECJ) sheds light on the question of whether a data controller can be exempted from liability for the error of a person acting under its authority.

The General Data Protection Regulation (GDPR) provides that a controller or processor is exempt from liability for breaches of the GDPR if it proves that it is not in any way responsible for the event causing the damage. The ECJ held that the controller must ensure that its employees follow instructions, and that this provision may not exempt the controller from liability for breaches caused by employee error.

The facts

A person doing business as an independent lawyer was a customer of a company operating a legal database. After the lawyer discovered that his personal data was being used for direct marketing purposes, he withdrew all his consents and opposed further processing of his personal data, except for newsletters. Despite his objection, he received two