EU Data protection liability: the exemption clause ex art. 82 under the European Court of Justice interpretation and the limits of harmonisation

This research examines the case-law of the Court of Justice of the European Union (CJEU) on the liability regime for unlawful data processing under the General Data Protection Regulation (GDPR). In particular, it focuses on the exemption clause provided for in art. 82(3) GDPR. Starting with judgment C-300/21, the CJEU has interpreted the terms and concepts contained in art. 82 GDPR as autonomous concepts of European Union law. This attempt at harmonisation is one of the few in the field of civil liability, which has traditionally been left to the competence of EU Member States. However, the GDPR does not provide all the elements necessary to establish the liability of data controllers. Building on this gap, this research explores the appropriate methodology to support the harmonisation process initiated by the GDPR, namely comparative law, and examines the doctrines of private law relevant to the attribution of civil liability in the realm of data protection.