ECJ: Associations may sue Meta for breach of information obligations

In the legal dispute between the Federation of German Consumer Organizations (vzbv) and Meta, the European Court of Justice (ECJ) has once again ruled in favour of the consumer advocates. According to a ruling on Thursday (Case C-757/22), an association action is also admissible if it concerns a breach of the information obligations on data processing as set out in the General Data Protection Regulation (GDPR).

The ruling comes at the end of a chain of court instances, starting in 2012 with a lawsuit brought by vzbv against Facebook Ireland, now Meta Platforms Ireland. At the time, the consumer advocates complained about data protection violations in the social network's App Center; the Berlin Regional Court up to the Federal Court of Justice (BGH) saw such violations.

vzbv authorized to sue?

However, the BGH questioned whether the vzbv had the right to sue in such cases. The ECJ affirmed this in 2022, and now also for cases involving breaches of GDPR information obligations. The ball is now back in the BGH's court, and the vzbv expects a final decision from the BGH soon.

The ECJ stated that Article 80(2) of the GDPR (Regulation 2016/679) on the representation of data subjects who wish to complain about breaches also applies if the data controller has not complied with its information obligations. Specifically, this means that the data subject was not provided with information about the purpose and recipients of the data "in a concise, transparent, intelligible and easily accessible form, using clear and plain language" at the latest when the data was collected, as stated in Article 12 of the GDPR (PDF).

(anw)