On 28 April 2022, the Court of Justice of the European Union (“CJEU”) delivered its judgment in Case C-319/20 Meta Platforms Ireland Limited v. Bundesverband der Verbraucherzentralen und Verbraucherverbaende (Federation of German Consumer Organizations).
In its decision, the CJEU found that a national law could allow consumer protection associations to bring legal proceedings against the person allegedly responsible for infringing the data subjects’ rights under the GDPR (in this case Meta Platforms, formerly Facebook Ireland Limited).
Moreover, the CJEU emphasized that a consumer protection association falls within the scope of the concept of a “body that has standing to bring proceedings” under the GDPR and can initiate legal proceedings for violations of the prohibition of unfair commercial practices, a breach of a consumer protection law, or the prohibition of the use of invalid general terms and conditions if the data processing is liable to affect the individuals’ rights under the GDPR:
- regardless of whether they have a specific mandate for that purpose,
- without having to identify the person specifically concerned, and
- without having to allege the existence of a specific infringement of the data protection rights.
The press release is available here, and the full decision is available here.
