Court decision · 14 December 2023
VB v Natsionalna agentsia za prihodite (Bulgarian National Revenue Agency)
Case C-340/21, ECLI:EU:C:2023:986 · Court of Justice of the European Union
What it means for your code
Keep evidence that your security decisions were reasonable when you made them — threat models, review records, the reason a control was chosen — because after a breach you have to prove it, not the claimant.
What happened
Attackers published the tax records of millions of people taken from a public authority's systems. Affected people sued for the distress of fearing future misuse, and the authority argued that an attack by a third party showed its measures had been adequate.
What was decided
A breach caused by an attacker does not by itself show the controller's measures were inadequate — nor does it excuse the controller, who bears the burden of proving the measures it chose were appropriate. Fear that data may be misused in future is, on its own, capable of being non-material damage.
The legal test applied
- A breach caused by a third party does not of itself prove the controller's measures were inappropriate (Art. 32)
- The controller bears the burden of proving the measures it adopted were appropriate
- Fear of future misuse of leaked data can constitute non-material damage under Art. 82
- The controller escapes liability only by proving it is in no way responsible for the event causing the damage
What would have changed the outcome
- Documented, proportionate measures assessed against the risk at the time shift the assessment
- Damage claims still require the claimant to prove the fear is well founded
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.