On 28 April 2022, the CJEU ruled that consumer protection associations may bring representative actions against infringements of laws protecting personal data.

The case at issue deals with an action for an injunction brought forward by the Federal Union of Consumer Organisations and Associations, Germany (Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband e.V.) against Meta Platforms Ireland, which manages the provision of services of the online social network Facebook. The Federal Union alleged that Meta Platforms Ireland had infringed rules on the protection of personal data, when it made available to users’ free games provided by third parties, and put forward the action on the basis of combat of unfair commercial practices and consumer protection. However, there was neither a specific infringement of a right to data protection of a data subject nor a concrete mandate from a data subject.

Against this background, the Federal Court of Justice (Bundesgerichtshof) casted doubts as to whether the Federal Union’s action was admissible and asked whether, following the entry into force of the General Data Protection Regulation (GDPR), a consumer protection association still has standing to bring proceedings in the civil courts against infringements of that regulation.

The CJEU decided that a consumer protection association, such as the Federal Union at issue, falls within the scope of the concept of a “body that has standing to bring proceedings” within the meaning of Art. 80 GDPR in that it pursues a public interest objective consisting in safeguarding the rights of consumers. The Court noted that such an interpretation is consistent with the objective pursued by the GDPR: ensuring a high level of protection of personal data.

The case is referred to as C-319/20, Meta Platforms Ireland Limited, formerly Facebook Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband eV.