Processing agents shall not be held liable only when they prove that:
I – they did not carry out the personal data processing that is attributed to them;
II – although they did carry out the processing of personal data that is attributed to them, there was no violation of the data protection legislation; or
III – the damage arises from the exclusive fault of the data subject or a third party.