Consumer associations can bring GDPR cases to court without demonstrating a specific violation of individual rights

The background of the CJEU ruling

In its judgment, the CJEU had to decide whether the GDPR precludes national law that allows consumer groups to bring GDPR claims to civil courts without being mandated by the data subjects, and irrespective of a specific infringement of data subject rights. The question had been referred by the German Federal Court of Justice regarding a case brought against Facebook Ireland. According to the German Federal Court of Justice, Facebook Ireland violated the GDPR by failing to provide users with the required information about the purpose of the data processing and the recipients of the personal data in a concise, transparent, understandable, and easily accessible manner and in clear and simple terms. However, the court was in doubt about the admissibility of the case, as the action was brought by the Verbraucherzentrale Bundesverband e.V. (German Federation of Consumer Organisations) without regard to a specific violation of data subject rights and without a mandate from a specific data subject. Indeed, German law allowed consumer associations to bring actions for alleged infringements of data subject rights. The main question of the case was, therefore, whether Art. 80 (2) GDPR precludes such a national law. This would have been the case, if Art. 80 (2) GDPR were to be interpreted as meaning that a national law may only allow representative actions if a specific violation of data subject’s rights is demonstrated.

The CJEU ruling

In its judgment, the CJEU decided that Art. 80 (2) GDPR does not preclude national law allowing consumer groups to bring GDPR claims to court without being mandated by data subjects and irrespective of the infringement of specific data subject rights. The court reasoned that, given the purposes of a representative action, it cannot be required that the association bringing the action identifies the specific data subject affected by an alleged data protection breach in advance. According to Art. 4 No. 1 GDPR, data subjects do not only include persons already identified, but also identifiable natural persons. Therefore, it is sufficient if a category or group of persons affected by the allegedly unlawful data processing is named (para. 68 of the decision). Moreover, Art. 80 (2) GDPR requires that the respective association “considers” data subject rights to be violated. Therefore the court argued that its wording does not require a specific violation of individual rights (para. 71 of the decision). Ultimately, the court argued that representative actions enable the prevention of numerous infringements of data subject rights and, therefore, could be more effective than individual lawsuits (para. 71 of the decision).

Significance of the judgment

This interpretation of the GDPR addresses the imbalance of power between companies processing data and data subjects. While individuals usually have limited resources and thus often refrain from appealing against decisions, consumer associations often have more resources to ensure that consumer rights are enforced. The CJEU ruling is an important step towards a more comprehensive protection of personal data. The CJEU decision is also consistent with the EU Directive on Representative Actions, which was introduced on 4 December 2020. This Directive will allow consumer associations in the EU to bring injunctions or collective redress claims against companies that violate EU law, including the GDPR, as long as certain criteria are met. The Directive must be implemented into national law by the member states no later than 25 June 2023. The CJEU judgment and the introduction of the Representative Action Directive, combined with the rising number of claims by individuals and consumer groups, as well as the increase in authority resources and the tendency to impose higher fines (see e.g. fines against WhatsApp and Amazon), should remind your company to ensure compliance with the requirements of the GDPR and to regularly review your compliance. The CJEU judgment alone unblocks more than twenty cases related to the GDPR brought by the European Consumer Association and its members according to their own information.