Court of Justice judgment · Case C-340/21
VB v Natsionalna agentsia za prihodite
- Case
- C-340/21
- Court
- Court of Justice
- Date of judgment
- 14 December 2023
- ECLI
- ECLI:EU:C:2023:986
- Instrument
- Regulation (EU) 2016/679 (GDPR)
- Provisions
- Article 5(2), Article 24, Article 32, Article 82
Holding (summary, not the official text)
A data breach by third parties does not in itself prove that security measures were inadequate; the controller bears the burden of proving appropriateness; fear of misuse after a breach can be non-material damage.
Checked against the official source on 28 October 2026.
Only the judgment as published by the Court of Justice is authoritative. This is reference material, not legal advice.