European Court of Justice: consumer organisations can take legal action in cases of GDPR violations

Can consumer organisations such as the Federation of German Consumer Organisations (Verbraucherzentrale Bundesverband e.V. – vzbv) take legal action if they observe breaches of the EU General Data Protection Regulation (GDPR)? Yes. The European Court of Justice (ECJ) has again confirmed that consumer organisations can also take legal action when GDPR information obligations are not complied with. The German Federal Court of Justice (BGH) sought clarification from the ECJ in the course of ongoing proceedings. Following the judgement from Luxembourg, the BGH is now expected to make a final ruling in the near future. The starting point was legal action taken by vzbv against Meta (Facebook). Ramona Pop, Executive Director of vzbv, says the following:

Consumers are often helpless in the face of the massive amount of data collected online. In many cases, service providers ignore consumers’ data protection rights. It is therefore all the more important for those affected to have strong partners by their side. Today’s ECJ ruling has made it very clear that consumer organisations can continue to object to violations of data protection laws and take cases to court, if necessary. The ruling sends a positive signal to consumers.

Background:

The Federation of German Consumer Organisations (vzbv) already took legal action against Facebook Ireland (now Meta Platforms Ireland) in 2012. This lawsuit concerns data protection breaches in the social network’s App Center. All relevant authorities, from the Berlin district court to the BGH, recognised that the law had been breached. However, the BGH questioned whether vzbv has the right to launch legal proceedings. The BGH called on the ECJ for clarification, which confirmed that vzbv does indeed have this right, including for cases relating to infringements of the GDPR obligation to provide information. The ECJ already confirmed the right to take legal action against violations of GDPR rules in 2022.