Legal development

Consumer protection associations can now bring representative class actions

Triangular Colorbond profiles

    On 11 June 2024, the CJEU (C 757/22) issued a landmark ruling arising from an online service provider's failure to fulfil its information obligations under Articles 13/14 GDPR which were deemed to constitute an infringement of data subject rights. Pursuant to Article 80(2) GDPR, the CJEU held that a consumer protection association can bring representative actions against the controller for violations of GDPR, even without a direct mandate from the affected data subjects and does not need to base its claims on proven actual damages suffered by any individual data subject. Consumer protection associations are now in a better position to challenge the practices of controllers, especially in relation to online platforms and app providers that collect and process large amounts of personal data.

    Authors: Alexander Duisberg (Partner); David Plischka (Associate); Lisa Kopp (Associate)


    The information provided is not intended to be a comprehensive review of all developments in the law and practice, or to cover all aspects of those referred to.
    Readers should take legal advice before applying it to specific issues or transactions.

    image

    Stay ahead with our business insights, updates and podcasts

    Sign-up to select your areas of interest

    Sign-up