Consumer protection associations can now bring representative class actions

On 11 June 2024, the CJEU (C 757/22) issued a landmark ruling arising from an online service provider's failure to fulfil its information obligations under Articles 13/14 GDPR which were deemed to constitute an infringement of data subject rights. Pursuant to Article 80(2) GDPR, the CJEU held that a consumer protection association can bring representative actions against the controller for violations of GDPR, even without a direct mandate from the affected data subjects and does not need to base its claims on proven actual damages suffered by any individual data subject. Consumer protection associations are now in a better position to challenge the practices of controllers, especially in relation to online platforms and app providers that collect and process large amounts of personal data.

Authors: Alexander Duisberg (Partner); David Plischka (Associate); Lisa Kopp (Associate)