ECJ Rules On Liability And Compensation In The Event Of Cyberattacks

In its judgment of 14 December 2023 (Case C-340/21), the European Court of Justice ("ECJ") answered various highly relevant questions regarding the adequacy of technical and organisational measures in the context of a cyberattack, the distribution of the burden of proof when assessing the appropriateness of technical and organisational measures, the possible exculpation of the controller in the event of cyberattacks and the question of whether a data subject's fear that their personal data may be misused already gives rise to a right to compensation for non-material damage.

A. Facts of the case

In July 2019, a cyberattack resulted in unauthorised access to the information system of the Bulgarian authority "Natsionalna agentsia za prihodite" ("NAP"), the National Revenue Agency. Tax and social security data of millions of people were published on the Internet. A large number of individuals, including the appellant in the main proceedings, therefore brought an