The European Court of Justice (ECJ) has to decide in a legal dispute between the Federal Association of Consumer Organizations (vzbv) and Facebook whether consumer protection associations can file a kind of class action against data protection violations. The advocate general in the proceedings that the Federal Court of Justice (BGH) submitted to the ECJ affirmed this in his opinion published on Thursday (Az. C-319/20).
The General Data Protection Regulation (GDPR) allows writes Advocate General Jean Richard de la Tour. Corresponding lawsuits would have to be based on the violation of rights that the persons concerned accrue directly from this law. The vzbv’s injunction against Facebook concerns a potential violation of the data protection obligation to inform users about the scope and purpose of the collection and use of their data. The conditions for a representative action are thus met.
In general, the protection of the collective interests of consumers by associations is particularly in line with the GDPR’s goal of creating a high level of protection for personal data, writes de la Tour. The Advocate General points out that the Court of Justice had already ruled similarly in an earlier judgment on Facebook functions on the website of a German clothing retailer. The opinions of the Advocates General are not binding on the ECJ. Often, however, the Luxembourg judges follow the advocate general’s plea. A judgment can be expected in the next few months.
The proceedings concern Facebook’s app center, which contains free online games from other providers. With the button “Play now”, the user gave permission to collect and evaluate personal data. A note read: “By clicking ‘Play Game’ above, this application receives: your general information, your email address, about you, your status messages. This app is allowed to post on your behalf, including your score and more . “
Consumer advocates entitled to sue?
The BGH turned to the ECJ in April 2019. The highest German court found that Facebook had not informed the users about the data processing and the recipient of the data in the clear and easily understandable form of the GDPR. At the same time, however, the judges had doubts as to whether the vzbv could sue Facebook regardless of the specific violation of the rights of individual data subjects and without their mandate.
In Germany, there has also been a model declaratory action as an instrument for around three years. In the first step, at least ten, later 50 consumers who have suffered damage must take part. Above all, the action taken by consumer advocates against VW due to the diesel affair is known. Profits from data abuse, for example, have not yet been skimmed off in this country. However, this is what the new requirements for EU-wide class actions provide.