Consumer advocates can sue Facebook

Without a specific mandate from those affected against data protection violations, consumer advocates can sue Internet giants like Facebook.

–
–

Luxembourg. On the question of whether consumer associations are allowed to take data protection violations at Internet giants like Facebook to court instead of affected users, a judgment is emerging in favor of the consumer advice centers.

The expert at the European Court of Justice (ECJ) came to the conclusion that the associations are entitled to take legal action, even if they do not have a specific mandate from those affected. This emerges from the recommendations to the ECJ. The reports are not binding, but the Luxembourg judges often follow them.

The ECJ has to deal with the question because the German Federal Court of Justice (BGH) was unsure in this matter whether a right to bring an action would not violate the European General Data Protection Regulation (GDPR). The specific case concerned the design of the Facebook “app center”, where free games from third-party providers are presented.

Apple of contention data protection

The umbrella association of consumer organizations had criticized that Facebook had violated data protection in the “app center”. At least in the 2012 version, users would have automatically consented to the transmission of various data to the game operator by clicking on “Play now”. They also authorized the applications to post – “status messages, photos and more”.

The Federal Association of Consumer Organizations (vzbv) initially took action against Facebook: The network did not provide sufficient information about which data was being passed on and what was happening with it, the Berlin Court of Appeal ruled in 2017. The case finally landed at the BGH in May 2020. There, the BGH judge Thomas Koch saw a relatively clear violation by Facebook of data protection law. The user remains unclear what will happen to his data, said Koch in May 2020. However, the question of whether associations like the vzbv are even entitled to take legal action remained unanswered.

In the proceedings, Facebook took the view that the GDPR only entitles the data protection officer to punish violations. With this, the EU legislator wanted to create legal certainty for companies, said the lawyer from Facebook before the BGH. National peculiarities ran counter to this.

The lawyer for the consumer advice centers contradicted this view: The aim was to enforce data protection standards quickly and as comprehensively as possible. The individual consumer will only rarely report a violation and even less will take them to court themselves.

Consumer advice centers help

The consumer advice centers have carried out eight proceedings against Facebook alone since 2009, said the head of the legal enforcement team at the vzbv, Heiko Dünkel. “Those affected themselves are usually not able to effectively enforce their rights in the event of massive data breaches by Facebook and other data vacuum cleaners.”

In Germany, not only the supervisory authorities can take action against data protection violations. Competitors and associations, institutions and chambers can also sue without being commissioned by a data subject.

The ECJ expert now took the position that the GDPR did not stand in the way of a German regulation. According to expert reports, EU countries can allow certain institutions to bring collective actions “to protect the collective interests of consumers” without commissioning the injured people.

A spokeswoman for the Facebook group Meta announced that her company would analyze the opinion of the advocate general. “Legal clarity as to the scope and procedures of the General Data Protection Regulation is important and we welcome the European Court of Justice to examine the issues raised in this case.”

© dpa-infocom, dpa: 211202-99-226596 / 3

– .