On Thursday 14 December, the Court of Justice of the EU (CJEU) handed down a judgment (C-340/21) in which it ruled that an individual’s fear of potential misuse of their personal data by third parties following a breach of the GDPR is capable, on its own, of constituting ‘non-material damage’.
The National Revenue Agency of the Republic of Bulgaria - responsible for identifying, securing and collecting public debts and, therefore, processing personal data - was taken to court by...