Sentence from the guide
The CJEU ruled in Case C-340/21 (Natsionalna agentsia za prihodite) that the occurrence of a data breach by third-party hackers does not automatically mean the controller’s security measures were inadequate under Article 32, though the controller bears the legal burden of proving its measures were appropriate.
English sentence from the linked guide on this site. Not an official headnote. The source link below is the authentic text of the decision. It is not a translation of this sentence.
Case details
| Court | EuGH |
|---|---|
| Instance | EuGH |
| Case number | C-340/21 |
| Date | 14.12.2023 |
| Area | Art. 32 DSGVO |
| Provisions cited | Art. 32 DSGVO |
See also
Source
EuGH, judgment of 14.12.2023, C-340/21
Stand: 10/2026 · An official headnote is shown only when it appears verbatim at the source. Not legal advice.