A decision by the European Union’s top court today is expected to unblock a slew of lawsuits filed by consumer advocacy groups seeking to enforce the bloc’s General Data Protection Regulation (GDPR) guidelines against tech behemoths like Facebook and Twitter over issues such as whether they obtain genuinely informed consent to process users’ data.
The Court of Justice of the European Union (CJEU) confirmed today that consumer protection groups could pursue collective proceedings against infringements of the EU’s data privacy regulations under GDPR.
The referral to the CJEU came from a court in Germany.
A case from Germany
The case was brought against Meta (Facebook) by the German Federal Union of Consumer Organizations (also known as the vzbv).
The case concerned the terms of service of specific free games applications installed on its platform. The games force consent from users by not having the choice to decline processing if someone plays.
A Meta spokeswoman said that the underlying legal procedures demonstrated certain unanswered questions, which the CJEU has now addressed, adding that Meta is looking into the implications.
The tide turned
The CJEU judgment foreshadows a larger change that will take effect throughout the EU next year when the Representative Actions Directive takes effect in June, allowing consumer rights organizations to act on behalf of individuals whose freedoms they think are being abused.
The statement by the court said;
“By today’s judgment, the court finds that the GDPR does not preclude national legislation which allows a consumer protection association to bring legal proceedings, in the absence of a mandate conferred on it for that purpose and independently of the infringement of specific rights of the data subjects, against the person allegedly responsible for an infringement of the laws protecting personal data, on the basis of the infringement of the prohibition of unfair commercial practices, a breach of a consumer protection law or the prohibition of the use of invalid general terms and conditions, where the data processing concerned is liable to affect the rights that identified or identifiable natural persons derive from that regulation”.
2 days ago
