Following the ECJ's decision of 11 July 2014 in Case C-757/22 , the German Federal Court of Justice (Bundesgerichtshof – BGH) has on 27 March 2025 finally ruled on the relationship between the German provisions in the Act onInjunctions for Consumer Rights and Other Infringements (UKlaG) and the Act against UnfairCompetition Act (UWG) and the GDPR. The BGH confirms the view of the ECJ and already allows for the standing of consumer protection associations under the UKlaG already in certainc cases for the violation of an information obligation under Art. 12 et seq. GDPR.

Background

The case before the BGH arose out of a legal dispute between the Federation of German Consumer Organisations (vzbv) and Meta Platforms Ireland Limited (Meta) regarding allegedly unlawful data processing by Meta in the so-called App Center. If users wanted to use a particular app, they had to accept, among other things, Meta's terms and conditions and privacy policy. The vzbv sees this as a violation of the law, as it considers consent obtained in this way to be invalid. Following the first referral by the BGH, the ECJ ruled in 2022 in Case C-319/20 that, in principle, consumer protection associations have the right to bring class actions. In response to the BGH’s second referral, the ECJ ruled in 2024 in Case C-757/22 that certain violations of the duty to provide information are sufficient to give rise to an injunction.

The court's opinion

The BGH has now issued a final ruling on the right of associations to bring actions under the UKlaG and UWG in relation to the GDPR. As expected, consumer protection associations can therefore reprimand data protection violations on the basis of the provisions of the UKlaG and the UWG and accordingly urge those responsible to refrain from infringing data protection laws. However, the prerequisite for this is that the infringement that is the subject of the reprimand occurs at least on the occasion of data processing within the meaning of the GDPR. A purely hypothetical processing is not sufficient as a starting point. Under data protection law, violations of the duty to provide information in a specific context may also constitute a violation of the information obligations under competition law or – as in the initial proceedings – invalid general terms and conditions. A violation of the transparency obligations can thus trigger the vzbv's right of action. However, the lawfulness of the data processing is usually not affected.

Practical recommendation

Companies must review the presentation, content and integration of the mandatory data protection information to ensure that it meets the transparency requirements of the GDPR. In particular, it must be clear for what purposes the data subjects' data is processed, on what legal basis and who the recipients of the data are. As a transparency benchmark, courts will refer to the case law on general terms and conditions.
In the Federal Court of Justice's 27 March 2025 “Lindenapotheke” decision, the Federal Court of Justice also confirmed the right of competitors to take action in the event of data protection violations by competitors, so that in the future, violations of information obligations can be enforced not only by authorities and consumer protection associations, but also by competitors.