Consumer protection associations can now bring representative class actions
06 August 2024
06 August 2024
On 11 June 2024, the CJEU (C 757/22) issued a landmark ruling arising from an online service provider's failure to fulfil its information obligations under Articles 13/14 GDPR which were deemed to constitute an infringement of data subject rights. Pursuant to Article 80(2) GDPR, the CJEU held that a consumer protection association can bring representative actions against the controller for violations of GDPR, even without a direct mandate from the affected data subjects and does not need to base its claims on proven actual damages suffered by any individual data subject. Consumer protection associations are now in a better position to challenge the practices of controllers, especially in relation to online platforms and app providers that collect and process large amounts of personal data.
Authors: Alexander Duisberg (Partner); David Plischka (Associate); Lisa Kopp (Associate)
The information provided is not intended to be a comprehensive review of all developments in the law and practice, or to cover all aspects of those referred to.
Readers should take legal advice before applying it to specific issues or transactions.
Sign-up to select your areas of interest
Sign-up