CIVIL LIABILITY OF OPERATORS FOR DAMAGES CAUSED BY PERSONAL DATA BREACHES

Abstract

This article examines, from a civil law perspective, the issues of compensation for material and moral damages caused to an individual as a result of a personal data breach. In determining the civil liability of operators who process personal data, the article analyzes the manifestation of the traditional elements of tort liability—unlawful action (or inaction), damages, causation, and fault—within the digital environment. Furthermore, the advantages and disadvantages of fault-based liability and strict (no-fault) liability models in cases of data breaches are considered from a comparative legal standpoint. The study substantiates the need to ease the burden of proof, given the victim's inability to independently verify the internal technical state of the operator's information system, and to establish special rules for determining the causal link between the operator's violation of information security obligations and the resulting damages. In conclusion, the article puts forward proposals for introducing a special provision into the Civil Code of the Republic of Uzbekistan regarding compensation for damages caused by personal data breaches.