Article 42
Repairing Damage to the Personal Data Holder
The controller or the operator who, due to the exercise of the activity of processing personal data, causes to others property, moral, individual or collective damage, in violation of the legislation of protection of personal data, is obliged to repair it.
- 1. In order to ensure effective compensation to the data subject:
- I - the operator is jointly and severally liable for the damages caused by the processing when he fails to comply with the data protection law obligations or when he has not followed the controller's lawful instructions, in which case the operator equals the controller, except in cases of exclusion provided for in art. 43 of this Law;
- II - the controllers who are directly involved in the treatment of which damage has occurred to the data subject jointly and severally, except in cases of exclusion provided for in art. 43 of this Law.
- 2. The judge, in civil proceedings, may reverse the burden of proof in favor of the data subject when, in his opinion, the allegation is probable, there is a sufficiency for the purpose of producing evidence or when the production of evidence by the data subject excessively costly.
- 3 - The actions of reparation for collective damages that have the object of the liability under the caput of this article can be exercised collectively in court, observing the provisions of the relevant legislation.
- 4. Anyone who repairs the damage to the holder shall have the right of recourse against the other responsible parties, as long as he / she participates in the harmful event.