Hacking For Plaintiffs' Money?

The European Court of Justice (CJEU) likely anticipated a wave of GDPR-related referrals. Few such matters receive as much attention from the public and lawyers as questions on GDPR damages.

Earlier this year, the CJEU decided in a landmark case C-300/21 that an award of non-material damages in accordance with Art 82 GDPR requires an infringement of the GDPR, damage suffered by the data subject, and a causal link between the unlawful processing and the damage (see also EU: CJEU lowers threshold for GDPR damages).

Up next is the case of a data subject worried about possible, but by no means certain or probable, future events after a hacker attack.

Four years ago...

The Bulgarian National Revenue Agency Natsionalna agentsia za prihodite ("NAP") informed Bulgarian and foreign nationals via the media of an unauthorised access to its information system. The NAP was hacked and various tax and social security information was published online. The incident