Processing agents shall only not be held liable when they prove...

Processing agents shall only not be held liable when they prove that:
I – they did not carry out the processing of personal data that is attributed to them;
II – although they did carry out the processing of personal data that is attributed to them, there was no violation of the data protection legislation; or
III – the damage arises from exclusive fault of the data subject or a third party.