The Court of Justice of the European Union (CJEU) ruled on Thursday, 28 April, that consumer protection associations can bring representative actions against infringements of the laws protecting personal data (Case C-68/22).
The German Federal Court of Justice has been considering the merits of a legal action for infringement of the laws protecting personal data that the German Federal Union of Consumer Organisations and Associations brought against Meta Platforms Ireland, the entity responsible for processing the personal data of Facebook users in the EU since the GDPR (2016/679) entered into force.
The Court of Justice of the EU has answered this question in the affirmative. The GDPR does not preclude national legislation that allows a consumer protection association to take legal action, in the absence of a mandate conferred on it for that purpose and independently of the infringement of the rights of individual data subjects, against the person allegedly responsible for an infringement of the laws protecting personal data.
The German Federal Union has accused Meta Platforms Ireland of infringing the rules on personal data protection, unfair competition, and consumer protection by making certain games available to users via its ‘Applications’ area, which—when consulted and after the general terms and conditions have been accepted by the user—allow the gaming company to obtain their personal data and to publish [data] on their behalf.
In particular, the CJEU noted that certain provisions of the GDPR allow a Member State to lay down additional rules, including the option of introducing a representative action mechanism against the person allegedly responsible for an infringement of the laws protecting personal data. It also added that the German Federal Union falls within the concept of a body with standing to bring proceedings within the meaning of the regulation in that it pursues a public interest objective.
Finally, according to the court, the GDPR does not preclude national provisions that provide that representative actions may be brought against infringements of the rights conferred by that regulation through rules that aim to protect consumers or combat unfair commercial practices.
Welcoming this decision, European Consumer Organisation (BEUC) Deputy Director General Ursula Pachl hoped the GDPR would be better implemented in the EU. As soon as next year, consumer associations in all EU countries will, if they meet certain criteria, be able to “launch injunctions or collective redress claims against companies that break the law, including under the GDPR”, she indicated in a press release.
See the judgment: https://aeur.eu/f/1et (Original version in French by Mathieu Bion)