Status: 02.12.2021 2:54 p.m.
When it comes to data protection violations on the Internet, individuals often feel powerless. As an association, consumer advocates could possibly take action against Facebook & Co. The ECJ still has to clarify whether this is permissible. An expert has already made a preliminary decision.
On the question of whether consumer protection associations are allowed to take data protection violations by Internet companies such as Facebook or Google to court instead of affected users, a judgment is emerging in favor of consumer advice centers: The expert at the European Court of Justice (ECJ), Richard de la Tour, came to the conclusion that the associations are entitled to sue – even without specific instructions from those affected. This emerges from the published recommendations to the ECJ. The reports are not binding, but the Luxembourg judges often follow them.
The German Federal Court of Justice (BGH) had asked the ECJ to clarify whether the provisions of the European General Data Protection Regulation (GDPR) oppose such a national regulation. The BGH therefore asked the ECJ on the matter in May 2020.
Criticism of the automatic transmission of data
The case began in 2012 when, according to the Federal Association of Consumer Organizations (vzbv), Facebook unlawfully allowed online game providers to collect personal data from players. Specifically, it was about the design of the “App Center” of Facebook, where free games from third parties are presented. The umbrella association of consumer organizations had criticized that Facebook had violated data protection in the “app center”.
At least in the 2012 version, users would have automatically consented to the transmission of various data to the game operator by clicking on “Play now”. They also authorized the game operator to post the applications – “status messages, photos and more”.
BGH saw a violation of data protection law
The vzbv had therefore initially successfully taken action against Facebook: The network did not provide sufficient information about which data was being passed on and what was happening with it, the Berlin Court of Appeal had ruled in 2017.
The case finally landed at the BGH in May 2020. Judge Thomas Koch saw a relatively clear violation of data protection law by Facebook. The user remains unclear what is happening with his data.
However, the question remained open as to whether associations like the vzbv are entitled to sue at all. In the proceedings, Facebook took the view that the GDPR only entitles the data protection officer to punish violations. With this, the EU legislator wanted to create legal certainty for companies, said the lawyer from Facebook before the BGH. National peculiarities ran counter to this.
GDPR probably does not stand in the way of German regulation
In Germany, however, not only the supervisory authorities can take action against data protection violations: Competitors and associations, institutions and chambers can also sue without being instructed by a data subject.
The ECJ expert now took the position that the GDPR did not stand in the way of a German regulation. According to expert reports, EU countries can allow certain institutions to bring collective actions “to protect the collective interests of consumers” without commissioning the injured people.
A spokeswoman for the Facebook group Meta announced that the company would analyze the advocate general’s latest statement. “Legal clarity as to the scope and procedures of the General Data Protection Regulation is important and we welcome the fact that the European Court of Justice is examining the issues raised in this case.”