The Member States may Allow Consumer Protection Associations to Bring Representative Actions Against Infringements of the Protection of Personal Data

Court of Justice of the European Union revealed Advocate General’s Opinion in Case C-319/20 on 2 December 2021.

In Germany, the Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e.V. (Federation of German Consumer Organisations, ‘the Federation’) complains that Facebook Ireland infringed, in the context of making available in the ‘App Zentrum’ (App Centre) of the platform free games supplied by third parties, rules on the protection of personal data, on combatting unfair competition and on consumer protection.

According to the Bundesgerichtshof (Federal Court of Justice, Germany), Facebook Ireland has not provided to users (in a concise, transparent, intelligible and easily accessible form, using clear and plain language) the necessary information relating to the purposes of the processing of the data and the recipient of the personal data. Thus, in its view, Facebook Ireland infringed the General Data Protection Regulation.

In his Opinion, Advocate General Jean Richard de la Tour proposes that the Court interpret the General Data Protection Regulation as meaning that that it does not preclude national legislation which allows consumer protection associations to bring legal proceedings against the person alleged to be responsible for an infringement of the protection of personal data, on the basis of the prohibition of unfair commercial practices, the infringement of a law relating to consumer protection or the prohibition of the use of invalid general terms and conditions, provided that the objective of the representative action in question is to ensure observance of the rights which the persons affected by the contested processing derive directly from that regulation.

In his view, the Member States may still provide for the possibility for certain entities to bring – without a mandate from the data subjects and without there being a need to claim the existence of actual cases affecting named individuals – representative actions designed to protect the collective interests of consumers, provided that an infringement of the provisions of that regulation which are intended to confer subjective rights on data subjects is alleged.

That is indeed the case of the action for an injunction brought by the Federation against Facebook Ireland.

The Advocate General also considers that the General Data Protection Regulation does not preclude national provisions which authorise a consumer protection association to bring an action for an injunction in order to ensure compliance with the rights conferred by that regulation by means of rules designed to protect consumers or to combat unfair commercial practices.

According to the Advocate General, the defence of the collective interests of consumers by associations is particularly suited to the objective of the General Data Protection Regulation of establishing a high level of personal data protection.

Kind regards,

Zumbul Attorneys at Law

info@zumbul.av.tr