Art. 42 The controller or the processor that, as a result of carrying out their activity of processing personal data

Art. 42

The controller or the processor that, as a result of carrying out their activity of processing personal data, cause material, moral, individual or collective damage to others, in violation of legislation for the protection of personal data, are obligated to redress it.

§1 In order to ensure the effective compensation to the data subject:

I – processors are jointly liable for damages caused by the processing when they do not comply with the obligations of data protection legislation or when they have not followed controller’s lawful instructions. In this last case, the processor is deemed equivalent to the controller, save from cases of exclusion as provided in Art. 43 of this Law;

II – controllers directly involved in the processing from which damages resulted to the data subject shall jointly answer, save from cases of exclusion as provided in Art. 43 of this Law.

§2 The judge, in a civil lawsuit, at her/his discretion, may reverse the burden of proof in favor of the data subject when the allegation appears to be true, there are no funds for the purpose of producing evidence or when production of evidence by the data subject would be overly burdensome.

§3 Lawsuits for compensation for collective damages, pursuant to the terms of the lead sentence of this article regarding liability, may be filed collectively in court, subject to the provisions of related legislation.

§4 Anyone who pays compensation for damages to the data subject has the right to demand compensation from the other liable parties, to the extent of their participation in the damaging event.