European Union: Issued ruling in lawsuit concerning consumer protection association's capacity to sue for data protection infringements (Meta Platforms Ireland v Federation of German Consumer Organisations)

On 11 July 2024, the Court of Justice of the European Union (CJEU) issued a ruling clarifying the interpretation of Article 80(2) of the GDPR on data protection infringements. The ruling stemmed from a reference by the Federal Court of Justice, Germany, concerning a representative action brought by the Federal Association of Consumer Centers and Consumer Associations against Meta Platforms Ireland. The ruling determined that a consumer protection association can bring a representative action under Article 80(2) of the GDPR even without a specific mandate from an affected individual and irrespective of a specific infringement of data subject rights. The ruling clarified that the action could be initiated if the association claims that a data subject’s rights were infringed due to a failure by the data controller to provide clear, concise, and transparent information about the purposes of data processing and the recipients of the data.