60In the present case, it should be noted that the GDPR does not lay down rules relating to the admission and probative value of evidence, such as an expert’s report, which must be applied by the national courts hearing an action for damages under Article 82 of that regulation and responsible for assessing, in the light of Article 32 thereof, the appropriateness of the security measures implemented by the controller concerned. Therefore, in accordance with what has been stated in the preceding paragraph of the present judgment and in the absence of rules of EU law governing the matter, it is for the legal system of each Member State to prescribe the detailed rules for safeguarding rights which individuals derive from Article 82 and, in particular, the rules relating to the types of evidence that make it possible to assess the appropriateness of such measures in that context, subject to compliance with those principles of equivalence and effectiveness (see, by analogy, judgments of 21 June 2022, Ligue des droits humains, C‑817/19, EU:C:2022:491, paragraph 297, and of 4 May 2023, Österreichische Post (Non-material damage in connection with the processing of personal data), C‑300/21, EU:C:2023:370, paragraph 54).
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.