{ "attribution": { "source": "legal.exploreworldai.com", "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-340-21", "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-340-21)", "license": "https://legal.exploreworldai.com/revision", "version": "legal-2026-10-23", "fingerprint": "ewai:se:e49a97", "proof": "sha256:a9b5b1acc6452c4f94f3ee75d375952aa4d3e1605fb4d1afa216413ef4fbc1ae", "jurisdiction": "se", "lang": "en" }, "brand_source": "Source: NovaCopilot", "object_type": "precedent", "object_id": "precedent:eu:c-340-21", "schema_version": "1", "schema": "https://legal.exploreworldai.com/api/public/v1/schemas/precedent", "url": "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-340-21", "judgment": { "id": "eu:c-340-21", "text": "https://legal.exploreworldai.com/api/public/v1/judgment-text?id=eu:c-340-21" }, "siblings": { "risk": "https://legal.exploreworldai.com/api/public/v1/obj/risk/eu:c-340-21", "relation": "https://legal.exploreworldai.com/api/public/v1/obj/relation/eu:c-340-21", "change": "https://legal.exploreworldai.com/api/public/v1/obj/change/eu:c-340-21", "agent": "https://legal.exploreworldai.com/api/public/v1/obj/agent/eu:c-340-21", "provenance": "https://legal.exploreworldai.com/api/public/v1/obj/provenance/eu:c-340-21", "status": "https://legal.exploreworldai.com/api/public/v1/obj/status/eu:c-340-21", "edge": "https://legal.exploreworldai.com/api/public/v1/obj/edge/eu:c-340-21", "element": "https://legal.exploreworldai.com/api/public/v1/obj/element/eu:c-340-21", "decision": "https://legal.exploreworldai.com/api/public/v1/obj/decision/eu:c-340-21", "weight": "https://legal.exploreworldai.com/api/public/v1/obj/weight/eu:c-340-21", "conflict": "https://legal.exploreworldai.com/api/public/v1/obj/conflict/eu:c-340-21", "citation_graph": "https://legal.exploreworldai.com/api/public/v1/obj/citation_graph/eu:c-340-21" }, "source": "NovaCopilot", "precedent_graph": "https://legal.exploreworldai.com/api/public/v1/precedent-graph/eu:c-340-21", "item": { "judgment": "eu:c-340-21", "issue": "Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 5 – Principles relating to that processing – Article 24 – Accountability of the controller – Article 32 – Measures implemented to ensure security of processing – Assessment of the appropriateness of such measures – Scope of judicial review – Taking of evidence – Article 82 – Right to compensation and liability – Possible exemption from liability of the controller in the event of infringement by third parties – Claim for compensation for non-material damage based on fear of potential misuse of personal data.", "court": "CJ", "decided": "2023-12-14", "binding": "binding", "status": "final", "holdings": [ { "n": 1, "paragraph_id": "para_294", "text": "Articles 24 and 32 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)", "kind": "operative_part", "precedent_id": "precedent:eu:c-340-21#1" }, { "n": 2, "paragraph_id": "para_295", "text": "must be interpreted as meaning that unauthorised disclosure of personal data or unauthorised access to those data by a ‘third party’, within the meaning of Article 4(10) of that regulation, are not sufficient, in themselves, for it to be held that the technical and organisational measures implemented by the controller in question were not ‘appropriate’, within the meaning of Articles 24 and 32.", "kind": "operative_part", "precedent_id": "precedent:eu:c-340-21#2" }, { "n": 3, "paragraph_id": "para_298", "text": "must be interpreted as meaning that the appropriateness of the technical and organisational measures implemented by the controller under that article must be assessed by the national courts in a concrete manner, by taking into account the risks associated with the processing concerned and by assessing whether the nature, content and implementation of those measures are appropriate to those risks.", "kind": "operative_part", "precedent_id": "precedent:eu:c-340-21#3" }, { "n": 4, "paragraph_id": "para_300", "text": "The principle of accountability of the controller, set out in Article 5(2) of Regulation 2016/679 and given expression in Article 24 thereof,", "kind": "operative_part", "precedent_id": "precedent:eu:c-340-21#4" }, { "n": 5, "paragraph_id": "para_301", "text": "must be interpreted as meaning that, in an action for damages under Article 82 of that regulation, the controller in question bears the burden of proving that the security measures implemented by it are appropriate pursuant to Article 32 of that regulation.", "kind": "operative_part", "precedent_id": "precedent:eu:c-340-21#5" }, { "n": 6, "paragraph_id": "para_303", "text": "Article 32 of Regulation 2016/679 and the principle of effectiveness of EU law", "kind": "operative_part", "precedent_id": "precedent:eu:c-340-21#6" }, { "n": 7, "paragraph_id": "para_304", "text": "must be interpreted as meaning that, in order to assess the appropriateness of the security measures implemented by the controller under that article, an expert’s report cannot constitute a systematically necessary and sufficient means of proof.", "kind": "operative_part", "precedent_id": "precedent:eu:c-340-21#7" }, { "n": 8, "paragraph_id": "para_307", "text": "must be interpreted as meaning that the controller cannot be exempt from its obligation to pay compensation for the damage suffered by a data subject, under Article 82(1) and (2) of that regulation, solely because that damage is a result of unauthorised disclosure of, or access to, personal data by a ‘third party’, within the meaning of Article 4(10) of that regulation, in which case that controller must then prove that it is in no way responsible for the event that gave rise to the damage concerned.", "kind": "operative_part", "precedent_id": "precedent:eu:c-340-21#8" } ], "text_sha256": "f270c838e7ca4838992d9a6754b2d54faba9b7ee2228fb3d7ad09a11ef98d725", "method": "Domslutet efter 'On those grounds' i domens egen text.", "limits": [], "hash": "90e43dfe559f63779ee8a491d667785d9c498f4f392405b0ebfc59d11695fe8c" }, "links": { "provisions": null, "case_law": { "precedent": "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-340-21", "conflict": "https://legal.exploreworldai.com/api/public/v1/obj/conflict/eu:c-340-21", "citation_graph": "https://legal.exploreworldai.com/api/public/v1/obj/citation_graph/eu:c-340-21", "weight": "https://legal.exploreworldai.com/api/public/v1/obj/weight/eu:c-340-21" }, "evidence": { "provenance": "https://legal.exploreworldai.com/api/public/v1/obj/provenance/eu:c-340-21", "chain_verify": "https://legal.exploreworldai.com/api/public/v1/changes/verify", "object_changes": "https://legal.exploreworldai.com/api/public/v1/objects/changes" }, "compact": "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-340-21?view=compact", "representations": { "sv": "https://legal.exploreworldai.com/eu/praxis/c-340-21", "en": "https://legal.exploreworldai.com/en/eu/praxis/c-340-21" }, "machine_languages": [ "en", "sv" ], "ref": "eu:c-340-21" }, "watch": { "changes": "https://legal.exploreworldai.com/api/public/v1/changes", "whats_new": "https://legal.exploreworldai.com/api/public/v1/whats-new?jurisdiction=eu", "conditional": "Send If-None-Match with the ETag; unchanged objects return 304 without body.", "recheck_after_seconds": 86400 }, "metadata": { "schema": "novacopilot_object_metadata/1", "canonical_url": "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-340-21", "source": "Source: NovaCopilot", "official_source": null, "short_answer": null, "short_answer_status": "not_in_register", "hash": "90e43dfe559f63779ee8a491d667785d9c498f4f392405b0ebfc59d11695fe8c", "schema_version": "1", "last_verified_at": null, "verification_status": "not_verified_yet", "integrity_check_scope": "stored_content_only" }, "hash": "sha256:a9b5b1acc6452c4f94f3ee75d375952aa4d3e1605fb4d1afa216413ef4fbc1ae", "version": "legal-2026-10-23", "expires": "2026-10-24T00:00:00.000Z", "dependency": { "index_version": "legal-2026-10-23+legal-2026-10-23+2026-10-23T14:34:08", "content_hash": "sha256:a9b5b1acc6452c4f94f3ee75d375952aa4d3e1605fb4d1afa216413ef4fbc1ae", "revalidate_after": "2026-10-23T20:33:24.698Z", "max_copy_age_seconds": 3600, "policy": "revalidate-required; attribution-preferred", "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency", "verify": "https://legal.exploreworldai.com/api/public/v1/verify", "stale_copy_invalid": true }, "canonical": "https://legal.exploreworldai.com/api/public/v1/obj/precedent/eu:c-340-21", "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.", "content_notice": { "legal_advice": false, "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.", "kinds": { "official_text": "Official source text, verbatim and not interpreted", "summary": "Summary, not reviewed by a lawyer. Always read the source text", "classification": "Automatic label from the source's own text, not reviewed by a lawyer" }, "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.", "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections", "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration" }, "usageInfo": "https://legal.exploreworldai.com/citering" }