The Court of Justice of the European Union ('CJEU') issued, on 28 April 2022, its judgment in Meta Platforms Ireland Limited, formerly Facebook Ireland Limited v Bundesverband der Verbraucherzentralen und Verbraucherverbände – Verbraucherzentrale Bundesverband eV (Case C-319/20), ruling that consumer protection associations may bring representative actions against infringements of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR'), following a request for a ruling from the German Federal Court of Justice.

Background to the case

In particular, the matter referred to the CJEU concerns a prospective action brought by the German Federal Union of Consumer Organisations and Associations related to the App Center service of Meta Platforms Ireland, whereby users can access free games provided by third parties. The CJEU outlined that when viewing some of those games, the users were informed that the use of the concerned application enables the gaming company to obtain a certain amount of personal data and gives it permission to publish such data on behalf of that user, and that by using that application, the user accepts its general terms and conditions and data protection policy. In addition, the CJEU noted that in the case of a specific game, the users were informed that the application has permission to post photos and other information on his or her behalf.

The CJEU further outlined that the German Federal Union considered that the information provided by the concerned games in the App Center was unfair and thus brought an action for an injunction against Meta, though this action was brought independently of a specific infringement of the right to data protection of a data subject and without a mandate from a data subject.

The Federal Court of Justice, having doubts as to the admissibility of the action brought by the Federal Union, subsequently referred the matter to the CJEU.

Findings of the CJEU

In particular, the CJEU ruled that taking into account Article 80(2) of the GDPR, a consumer protection association, such as the Federal Union, which pursues a public interest objective consisting in safeguarding the rights and freedoms of data subjects in their capacity as consumers, may have standing in accordance with the GDPR.

Specifically, the CJEU found that the bringing of a representative action neither requires the entity to identify the person specifically concerned by the data processing that is allegedly in violation of the GDPR, nor for there to be a specific infringement of the rights under the GDPR. Rather, the CJEU clarified that it is sufficient to claim that the data processing concerned is liable to affect the rights of identified or identifiable natural persons under the GDPR, without it being necessary to prove actual harm suffered by the data subject, in a given situation, by the infringement of his or her rights, meaning that consumer protection associations such as the Federal Union are able to bring representative actions.

You can read a summary of the judgment here.