Data protection violations by Meta and Co: ECJ confirms extensive right of consumer organisations to take legal action to enforce GDPR

In a landmark ruling the European Court of Justice (ECJ) has significantly strengthened the right of consumer associations to sue companies that violate the General Data Protection Regulation (GDPR). Consumer organisations such as the Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband e. V.; vzbv) can file lawsuits without a mandate from a data subject and independently of the violation of concrete rights of affected consumers if the national law provides for this. Member States have a high degree of discretion in shaping such rights when implementing the rules. The Court agreed with the opinion of the EU Advocate General Richard de la Tour who had argued in favour of a very far-reaching admissibility last December. Jutta Gurkmann, Executive Director of the Federation of German Consumer Organisations (vzbv), comments:

It is no secret that some European data protection authorities have difficulties to combat the rampant data collection by big technology companies. In the past, the lack of enforcement has increasingly weakened the acceptance of the GDPR. Today's decision puts an end to the tiresome debate about the right of consumer organisations to take legal action to enforce data protection rights. Now it is clear: in addition to the supervisory authorities, civil society organisations such as vzbv can also sanction far-reaching violations of the GDPR. vzbv has been suing Meta, Google and Co. successfully and efficiently for a long time. Today's ECJ ruling creates legal certainty until the European Directive on Representative Actions will be transposed at the end of the year, which will also contain such a right.

The Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband e. V.; vzbv) had sued Facebook Ireland (now Meta Platforms Ireland). According to vzbv, the company had infringed rules on the protection of personal data, on combating unfair competition and on consumer protection when offering free games from third-party providers in its “App Centre”.

The Berlin Regional Court and the Berlin Court of Appeal had each issued cease-and-desist orders against Facebook.

The Federal Court of Justice also assumes a violation of the General Data Protection Regulation (GDPR) but had referred questions of interpretation on vzbv’s legal standing to the European Court of Justice (ECJ).