probably not in the EU - at least not if some kind of negligence, as specified by the GDPR, took place.