Adeguata gestione del rischio e presunzione di colpa nell’imputazione del danno da illecito trattamento di dati personali

The paper deals with the liability issue related to the processing of personal data in light of the scholarly debate and the recent rulings of the Court of Justice that have established the fault-based nature of the tort under Article 82 GDPR. On the one hand, it stresses that the presumption of fault on the part of the data controller (understood as the objective mismatch between the accident and the ex-ante damnum security expectations) adequately strikes the aim of balancing between the need to protect individuals and the concern for the development of the digital economy. On the other hand, it highlights some misalignments between theoretical claims and operative outcomes (e.g., in the case of wrongdoing by the employee within the organisation of the processing subject). Lastly, the paper points out that the broadness of the assessment of fault could easily lead to the resurrection, in the implementation of Article 82 GDPR by the national courts, of a substantial strict liability regime.