…provides for an exemption from liability if the data controller (or data processor) proves that it is not in any way responsible for the event giving rise to the damage.”

…precludes any subsequent recourse proceedings against other controllers or processors involved in the same processing.”

...can only be exercised against the data controller, even if a data processor was involved in the same processing.”

…is limited to a maximum amount of EUR 20 million per event of damage or loss.”