Right to compensation and liability
Any person who has suffered material or immaterial damage as a result of a breach of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.
Any controller involved in processing shall be liable for the damage caused by processing in breach of this Regulation. A processor shall be liable for damages caused by processing only if the processing did not comply with the obligations of this Regulation specifically addressed to processors or acted outside or contrary to the lawful instructions of the controller.
A controller or processor shall be exempted from liability under paragraph 2 if it proves that it is not in any way responsible for the harmful event.
Where several controllers or processors are involved in the same processing, and are responsible for damage caused by processing pursuant to paragraphs 2 and 3, each controller or processor shall be held liable for the entire damage in order to ensure that the data subject is effectively compensated.
Where a controller or processor has fully compensated the damage in accordance with paragraph 4, that controller or processor may recover from other controllers or processors who were involved in the processing the part of the compensation corresponding to their share of the liability for the damage, in accordance with the conditions set out in paragraph 2.
Judicial proceedings for the exercise of the right to compensation shall be conducted before the courts of the Member State referred to in Article 79(2).
