On 28 April 2022, the Court of Justice of the European Union ruled that consumer representative associations may bring representative actions against infringements of personal data protection without the specific mandate of a data subject (case C-319/20).
The case began when the Federal Union of Consumer Organizations and Associations based in Germany (hereafter “Federal Union”) brought an action for an injunction against Meta Platforms Ireland Limited (formerly Facebook Ireland Limited) alleging the infringement by Meta Platforms of the rules on the protection of personal data and consumer protection. The case brought by the Federal Union did not state a specific infringement of a data subject’s right to protection of his or her data. Moreover, the Federal Union did not have a specific mandate from a data subject to bring a claim against Meta Platforms.
The Federal Court of Germany, where the case was originally brought, had doubts about the admissibility of the action, and more specifically about whether a representative association such as the Federal Union has the standing to bring claims concerning personal data infringement without a specific mandate from a consumer to do so in light of the General Data Protection Regulation (“GDPR”).
The Court of Justice has now answered the question in the affirmative, stating that the GDPR does not preclude national legislation that allows a consumer protection association such as the Federal Union to bring claims without having the specific mandate to do so.
The Court of Justice reiterated that the goal of the GDPR was both the harmonization and the strengthening of data protection legislation. However, the provisions of the regulation make it possible for Member States to lay down additional, stricter or derogating national rules, which leave them a margin of discretion as to the manner in which those provisions may be implemented (“opening clauses”). Article 80(2) of the GDPR gives Member States that discretion with regard to its implementation. Of course, Member States must legislate in such a way as not to undermine the content and objectives of the GDPR and its provisions, including Article 80(2).
In this regard, a consumer protection association may fall within the personal scope set out by Article 80(2) in that it pursues a public interest objective consisting of safeguarding the rights and freedoms of data subjects in their capacity as consumers. The attainment of such an objective is likely to be related to the protection of the personal data of those persons.
As regards the material scope, the exercise of the representative action provided for in Article 80(2) presupposes that the entity, independently of any mandate conferred on it, considers that the rights of a data subject have been infringed as a result of the processing of his or her personal data. It follows that, in order to recognise that such an entity is able to bring claims concerning data protection under Article 80(2) GDPR, it is sufficient to show that the infringement is liable to the rights which identified or identifiable natural persons derive from the regulation, without prior individual identification of the person specifically concerned by data processing and without the necessity to prove actual harm caused to the data subject by the infringement.
Allowing a consumer association to bring such a claim against a company infringing on the data protection rights only strengthens consumer protection and may even be more effective than claims brought by individual data subjects.
Please contact Karel Janssens for further information about this topic and/or for general advice relating to privacy and data protection.