On December 14, 2023, the Court of Justice of the European Union
("CJEU") delivered a landmark judgment, following the
request of a preliminary ruling, in the case of VB v.
Natsionalna agentsia za prihodite (C 340/21) whereby the Court
examined, among other aspects, liability and non-material damage
under the EU General Data Protection Regulation
("GDPR").
Background
A cyber-attack committed against the Bulgarian National Revenue
Agency (the "Agency") resulted in a data breach affecting
over 6 million Bulgarian citizens and foreign nationals. The breach
prompted legal actions from several hundred affected individuals,
including the main appellant in the proceedings, who sought
compensation from the Agency claiming non-material damages incurred
due to the fear of the possible misuse and potential harm that
could arise as a result of the unauthorized disclosure of their
personal data.
