They do not need to wait for a concrete violation of the right to the protection of personal data or for a person to give them a mandate to act: consumer defense associations can bring actions before the civil courts if they notice GDPR (General Data Protection Regulation) breaches. The decision of the Court of Justice of the European Union, handed down on April 28, confirms the admissibility of the action of the Federal Union of German Consumer Centers and Associations against the controller of the personal data of Facebook users in within the EU Meta Platforms Ireland – formerly Facebook Ireland. The German Federal Court of Justice, seized by the Federal Union, had turned to the judges of Luxembourg to clarify this point.
The entry into force of the GDPR has not extinguished the power to act of consumer associations. They can take legal action against the alleged perpetrator of a breach of the protection of personal data, regardless of the violation of the concrete rights of the persons concerned, “since the processing of the data concerned is likely to affect the rights that identified or identifiable natural persons derive from this regulation”. These associations, moreover, come under the notion of“body with standing” defined by the GDPR: they pursue a public interest objective aimed at protecting consumers. Violations of consumer law rules – unfair commercial practices, use of void terms and conditions, etc. – reported by consumer defense associations can be “related to the violation of a rulerules relating to the protection of personal data”. The idea of the GDPR, recalls the Court, is to ensure a high level of protection of personal data. It remains to be seen whether other consumer protection associations in Europe will decide to attack large companies: their means may not allow it.
Olivia Fuentes
–
