A difficult puzzle: the duty of care in Member States’ tort law and the GDPR

The liability regime and relating duty of care of controllers and processors is the result of the triangulation of the GDPR, its interpretation by the CJEU, and the wide range of Member States’ duty of care doctrines in extracontractual liability. National liability regimes differ greatly from each other, and their interaction with the GDPR gives life to unexpected variances in the implementation of art 82. This article offers an overview of the roles of duties of care in the tort regimes of selected Member States, and their tensions with art 82 GDPR.