Cybercrime: the fear of a possible misuse of personal data is capable, in itself, of constituting non-material damage (ECJ)
According to the Judgment (14.12.2023) of the Court of Justice in Case C-340/21 (Natsionalna agentsia za prihodite), the fear of a possible misuse of personal data is capable, in itself, of constituting non-material damage. The Bulgarian National Revenue Agency (the NAP) is attached to the Bulgarian Minister for Finance. In particular, it is responsible for identifying, securing and recovering public debts. In this context, it is a personal data controller. On 15 July 2019, the media reported an intrusion into the NAP IT system, revealing that, following that cyberattack, personal data concerning millions of persons had been published on the internet. Many individuals brought legal actions against the NAP for compensation for non-material damage caused by the fear that their data might be misused. The Bulgarian Supreme Administrative Court refers several questions to the Court of Justice for a preliminary ruling on the interpretation of the General Data Protection Regulation (GDPR) .