Consumer protection associations granted right to take legal action in case of data protection violations
In its judgment of March 28, 2024 (Case No. I ZR 186/17), the Federal Court of Justice (BGH) clarified that consumer protection associations are permitted to bring legal actions in cases of alleged violations of data protection law. This principle is based on a groundbreaking interpretation of the interplay between the General Data Protection Regulation (GDPR) and national collective consumer protection regulations. The decision takes into account the ongoing development of data protection law at both European and national levels and expands the scope of action for civil society actors in enforcing data protection interests.
Background of the BGH decision
Specifically, the BGH addressed the question of whether German law applies to collective actions brought by associations against potential data protection violations and whether the legal standing of consumer protection associations is consistent with the requirements of the GDPR. The case concerned the use of online platforms and the processing of personal data without the users’ explicit consent. A consumer protection association filed for an injunction against a platform operator, citing non-compliance with data protection regulations.
European legal requirements and national implementation
GDPR and collective legal protection
The European General Data Protection Regulation provides in Article 80 GDPR that certain institutions, organizations, and associations may bring actions independently of an individual mandate from affected persons when their rights under the GDPR have been infringed. The objective of the European legislator is to ensure effective enforcement of data protection, including through the so-called collective legal protection. The modalities of implementation are left to the Member States, but must not undermine the protective purpose of EU law.
National regulations and supplementary provisions
In Germany, this collective legal protection has been implemented, among other things, through the Injunctions Act (UKlaG) and supplementary provisions in the German Civil Code (BGB). This allows qualified associations to pursue violations of consumer protection regulations, including those from data protection law. In its decision, the BGH affirmed the compatibility of this authority with the GDPR and found that the ability of German consumer associations to bring legal action does not depend on a direct mandate from an affected person.
Practical implications for companies and consumers
Corporate perspective
For companies, this decision entails increased sensitivity in handling personal data. In addition to supervisory measures, violations—particularly in digital business operations—are now more likely to become the target of collective legal actions by associations. This particularly concerns obligations regarding transparency, consent requirements, and the proper design of cookie banners and privacy policies.
Significance for consumers
Consumers benefit from strengthened legal enforcement. Collective actions relieve the burden on individuals and provide an additional opportunity to have data protection violations reviewed by courts. Increased oversight by associations contributes to greater transparency and the building of trust in the digital marketplace.
Retrospective: Assessment by the European Court of Justice
Even in advance, the European Court of Justice (ECJ), in a preliminary ruling procedure (Judgment of 28.04.2022, Case C-319/20), established that associations may have standing to sue independently if a data protection violation also impairs consumer interests. The German legislator and case law are now consistently implementing these findings, thereby extending the instrument of legal protection in data protection.
Perspectives and further developments
The decision fits into a continuing trend of strengthening collective legal enforcement in Germany and Europe. Even global providers offering their services within the European area now face new challenges in terms of data compliance management. In light of ongoing developments in data protection law and expected ECJ rulings, the issue remains dynamic.
Source and reference note
The information presented is based on the decision of the Federal Court of Justice from March 28, 2024 (Case No. I ZR 186/17) as well as relevant European and German statutory provisions. It should be noted that further proceedings on the topic may be pending and case law is continually evolving. The presumption of innocence and the relevant procedural rights are always respected.
For more in-depth information regarding the issues mentioned and current developments in collective consumer protection or data protection law, the Rechtsanwalt at MTR Legal will be pleased to assist you.
