I –they did not carry out the processing of personal data that is attributed to them;
II –although they did carry out the processing of personal data that is attributed to them, there was no violation of the data protection legislation; or
III –the damage arises from exclusive fault of the data subject or a third party.