European Union: Issued opinion by the Advocate-General of the EU Court of Justice (Case C-340/21)

On 27 April 2023, the Advocate General issued an opinion regarding Case C-340/21. It concerns the 15 July 2019 National Revenue Agency (NAP) of Bulgaria data breach resulting in the posting of tax and social security information on the internet. Individuals had brought proceedings against NAP in local courts. NAP's involvement was not found to have been liable for the individuals involved, and in the appeal process, the case was referred to the European Court of Justice. The Advocate General noted that a data breach is not a sufficient condition to solely determine whether the hasn't adopted appropriate and legally required measures. Additionally, the Advocate General stated that when national courts adjudicate on the security measures implemented by the controller, the impact and the risks for individuals must be assessed on a case-by-case basis. Specifically, the adoption of the codes of conduct and/or certification systems in place needs to be investigated. The local courts are required to verify that the measures are being implemented and that they are in compliance with regulations. However, the controller is still required to show that the measures taken were appropriate. The burden of proof is, therefore, on the controller. Liability of the data leak can only be removed from the controller if he/she can show that he/she bore no responsibility for the damage. Finally, individuals whose data has been leaked are eligible for material compensation, even if it concerns fear of possible misuse in the future. However, the individual would have to prove the existence of "emotional damage".