Can a corporate entity face GDPR fines for completely accidental human errors?

Can GDPR administrative fines be imposed for infringements that are not the result of either intent or negligence? (e.g. excusable, non-negligent human error)
The CJEU Advocate General Campos S�nchez-Bordona says “No”.

Others have already reported on the consequences of the new Opinion in the Deutsche Wohnen case (C?807/21) from the perspective of whether an undertaking can be liable for the actions of persons who, “without themselves being representatives of a legal person, act under the authority of persons who, as representatives of the legal person, have failed to exercise supervision or control over them” [= employees who act under the authority of management of the legal entity].
The principle of liability of an employer for the actions of employees is the norm already in general, but there are exceptions (notably to safeguard against liability for the actions of a rogue employee), so we will have to see whether the Court of Justice confirms this unconditionally.

On the issue of negligence/intent, the AG’s Opinion is particularly important, as it strengthens an argument that controllers and processors are often confronted with in practice: to err is human, and sometimes things can happen that are not intentional but not negligent either. This happens when you have taken reasonable measures to comply, but still a data protection infringement occurs.
There is then no strict liability according to the AG – i.e. no liability purely as a result of something being contrary to the GDPR. Instead, supervisory authorities must examine whether the infringement can be excused.
Again, we will have to see whether the Court of Justice confirms this position.

This Opinion is particularly interesting when put next to the (equally new) Opinion of AG Pitruzella in case C?340/21 (VB v Natsionalna agentsia za prihodite). In that Opinion, the AG states that “the mere existence of a ‘personal data breach’ […] is not in itself sufficient to conclude that the technical and organisational measures implemented by the controller were not ‘adequate’ for the purpose of protecting the data in question”.

Put them together, and it shows that these AGs understand that cybersecurity and data protection compliance are never 100% effective. If you do what you can, you have a story to tell a judge or authority.
Just make sure you document it in advance.

C-807/21 Opinion: https://lnkd.in/e6Ub2sB7
C-340/21 Opinion (no English available): https://lnkd.in/ebJgN4sp