With a decision dated 28.05.2020, the First Civil Senate of the Federal Court of Justice (BGH), which is responsible for competition law, among other things, once more suspended the proceedings of the German Federation of Consumer Organisations (VZBV) against Facebook Ireland Limited (Facebook). In doing so, the BGH refers the question to the Court of Justice of the European Union (CJEU) for a preliminary ruling as to whether the VZBV is authorised to take action against an infringer before the civil courts for breaches of the General Data Protection Regulation, irrespective of an infringement of specific rights of individual data subjects and without the instructions of a data subject.
Background to the proceedings
In 2014, before the GDPR came into force, the VZBV had filed a complaint against Facebook for violations of the old Federal Data Protection Act and the now superseded Data Protection Directive.
In its complaint, the VZBV criticised the data protection notice of Facebook's "App Centre", which is displayed to users before they consent to the disclosure of their personal data to third parties. The VZBV is of the opinion that the information provided by Facebook is insufficient, as the scope and purpose of the data processing is not made sufficiently clear to users. As a result, no effective consent under data protection law can be obtained, as no informed decision is made by the users. Both the Berlin Regional Court and the Court of Appeal at second instance followed the reasoning of the VZBV.
Facebook then went to the BGH, which had doubts about the VZBV’s right of action and suspended the proceedings for the time being by a decision dated 11.04.2019 in order to await the judgement of the European Court of Justice in the “Facebook Like-Button” case. In its judgement dated 29.07.2019, the CJEU confirmed the VZBV’s right of action, but only for the period before the GDPR came into force.
Apparently, this decision of the CJEU was not sufficient for the BGH judges to accept the right of action of the VZBV also for the time after the GDPR came into force and to decide on the merits of the case in question. Therefore, the BGH would now like to know from the CJEU whether the VZBV in this case also has the right for action for the time after the GPR came into force.
Significance of the question referred to the CJEU
The GDPR expressly provides for the right of consumer associations to bring an action only in the event that an action is brought on behalf of an individual claiming a specific infringement. However, the GDPR does not provide for an independent right of action for consumer associations, irrespective of the infringement of specific rights of individual affected persons and without a mandate from an affected person.
However, such an independent right of action for consumer associations would exist under the Unfair Competition Act (UWG) if the provisions of the GDPR on the right of action of consumer protection associations were not exhaustive and if the GDPR provisions were market conduct rules within the meaning of the UWG. The UWG entitles consumer associations to take legal action for injunctive relief for the violation of such market conduct rules.
Outlook
The question of the right of action of consumer associations under the GDPR is of great practical relevance for responsible companies. If the BGH were to affirm the right to bring an action here, abstract infringements of the GDPR could be prosecuted in court by the consumer protection associations, without a specific infringement of rights to the detriment of a specific affected party. Consumer associations are specialised in the sanction of competition violations and are more litigious than private individuals, due to the means at their disposal. In this case, those responsible would have to reckon with a significantly increased risk of legal actions against them.
