The EU Court of Justice ruled on Thursday (28 April) that consumer groups can autonomously bring legal proceedings for alleged breaches of data protection rules as long as national law allows it.
The ruling results from a lawsuit by the Federation of German Consumer Organisations against Facebook. The social network was accused of not providing a clear explanation of how it was processing personal data on its gaming platform App Centre.
The alleged infringement of data protection rules entailed an unfair commercial practice for the consumer group, breaching consumer protection laws. The German association brought this case autonomously, as a representative action.
The EU’s data protection legislation, the GDPR, Article 80 in particular, leaves room for national legislation to allow consumer groups to bring representative actions when mandated by concerned individuals.
As none mandate the consumer association, in this case, Facebook argued that the GDPR should preclude such options, even when allowed by national law.
As a result, the German court turned to the Court of Justice of the European Union (CJEU), which rejected Facebook’s argument.
A spokesperson from Meta, Facebook’s parent company, said that “the underlying legal proceedings showed that there were some open questions, which the CJEU has now addressed. We will review the decision and assess its implications”.
In December, the advocate general, a legal advisor to the court, issued a non-binding opinion on the same lines.
The advocate general noted that, in a digitalised economy, personal data affects individuals in their capacity as consumers. Moreover, it would be paradoxical that a law intended to protect personal data reduced the protection of consumer rights, the legal expert said.
Robert Bateman, head of content at GRC World Forums, hailed the ruling as “a major win for consumer groups, and we are likely to see a rise in these sorts of representative claims”.
“In my opinion, actions led by consumer groups are preferable to class action cases backed by giant litigation funders that take a significant cut of any damages.”
The ruling strengthens consumer groups’ rights as they are deemed to fall within the scope of the organisations that can bring legal proceedings under the GDPR for pursuing a public interest objective, consumer protection, related to the protection of personal data.
For the CJEU, these associations can put forth representative actions regardless of whether they have been mandated or not by one or more specific individuals, as both cases are in line with the objective of the GDPR, which is to ensure a high level of protection of personal data.
“The judgment confirms once again how data protection is intertwined with numerous other disciplines such as consumer law but also, outside this concrete case and as we have been seeing for some time, with competition law or more recently even with the DSA, as seen in the Parliament’s amendments,” said Vincenzo Tiani, a partner at the law firm Panetta.
However, it should be noted that not all national legislations in the EU allow for such empowerment of consumer groups.
Therefore, the judgment might lead to so-called ‘forum shopping’ across the bloc, as the consumer associations might decide to start a lawsuit in the jurisdiction with more favourable consumer protection laws.
“What may be assumed as certain, however, is that the European consumer associations are well networked and that German consumer associations, together with other European consumer associations with comparable legal bases, will certainly take on a pioneering role in enforcing data protection violations,” said Stefan Hessel, an attorney-at-law at reuschlaw legal consultants.
At the same time, the significance of this ruling and the related forum shopping phenomenon might have a tight time limitation.
By the end of 2022, member states need to transpose into national law the EU’s Representative Actions Directive, which will enable consumer groups that meet specific criteria to launch representative actions for breaking several EU laws.
The new directive will enter into application in June 2023.
“It will then be possible for consumer associations in all EU countries, as long as they meet certain criteria, to launch injunctions or collective redress claims against companies that break the law, including under the GDPR,” said Ursula Pachl, deputy director-general of the European Consumer Organisation (BEUC).
“A new era in enforcement by consumer groups will then begin.”
[Edited by Zoran Radosavljevic]