A controller or processor shall be exempt from liability beneath paragraph 2 if it proves that it isn't in any method liable for the event...