The GDPR introduces direct liability of processors, as well as controllers, for breaches of the GDPR, with regard to both supervisory authorities and data subjects. This is indicated in the following provisions at least:
Article 82(1) GDPR:
Any person who has suffered material or non-material damage as a result of an infringement of this Regulation shall have the right to receive compensation from the controller or processor for the damage suffered.
Article 83(3) GDPR:
If a controller or processor intentionally or negligently, for the same or linked processing operations, infringes several provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified for the gravest infringement.
In principle, a processor is responsible only for its own errors and omissions but is not responsible for the actions of the controller – but this is not the whole story.
From Article 82(2) GDPR it results that a processor is also responsible for the legality of the instructions of the controller. Pursuant to this provision:
A processor shall be liable for the damage caused by processing only where it has not complied with obligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful instructions of the controller.
Pursuant to the GDPR, the liability of a processor covers all aspects of the liability of the controller, though in a different way. The processor (and any other processors) is directly liable for data security, for processing data only for the controller and for refusing to carry out unlawful instructions. From Article 28 GDPR, and from an interpretation of Articles 13, 14 and 22, it results that a processor’s obligation to use due diligence also extends to support in performing the obligations of the data controller (e.g., if the processor sends data outside the European Economic Area, it should notify the controller so that the controller can meet its information and other obligations. It is similar if a processor’s services involve data profiling. The processor is also obliged to support the controller ‘to the extent possible’ in exercising the rights of individuals, etc.).
Finally, remember that liability does not rest solely with the entity directly doing the processing, but encompasses the entire chain of engagement and further data processing (subprocessing). The GDPR does not use the jargon term ‘subprocessors’ – only ‘other processors’ (Article 28(2, 4) GDPR). Thus, every entity that takes part in unlawful data processing will incur civil liability (unless it can show, as stated in Article 82(3) GDPR that ‘it is not in any way responsible for the event giving rise to the damage’). It would not be possible to wriggle out of administrative liability by saying that you are just ‘another cog in the data processing wheel’ if you are the cog that failed.