The Second Panel of the Superior Court of Justice ("STJ") has unanimously held that a security incident involving a leak of non-sensitive personal data does not automatically grant the affected data subjects an indemnification right against controllers, as per the decision published on March 10, 2023, on the Interlocutory Appeal in Special Appeal No. 2.130.619. In this scenario, there is no presumed moral damage that would automatically give rise to the duty to indemnify. Therefore, it is up to the individual to evidence the moral damage suffered as a result of the leak of their personal data.
