Article 76. Right to compensation and liability

(1) Any person who has suffered material or non-material damage as a result of an infringement of this Law shall have the right to receive compensation from the controller or processor for the damage suffered.

(2) Any controller involved in processing operations shall be liable for the damage caused by its processing operations which infringe this Law. A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Law specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.

(3) A controller or processor shall be exempt from liability under paragraph (2) if it proves that it is not in any way responsible for the event giving rise to the damage.

(4) Where more than one controller or processor, or both a controller and a processor, are involved in the same processing operation and where they are, under paragraphs (2) and (3), liable for any damage caused by processing, each controller or processor shall be liable for the entire damage in order to ensure effective compensation of the data subject.

(5) Where a controller or processor has, in accordance with paragraph (4), paid full compensation for the damage caused, that controller or processor shall have the right to claim back from the other controllers or processors involved in the same processing operation that part of the compensation corresponding to their part of liability for the damage, in accordance with the conditions set out in paragraph (2).

(6) Actions for the exercise of the right to recover compensation shall be brought before the competent courts in accordance with the legislation.