On 2 December 2021, Advocate General Richard de la Tour delivered his opinion on the CJEU case Meta Platforms Ireland v BVV (ECLI:EU:C:2021:979). The case involves the interpretation of Article 80(2) of the General Data Protection Regulation (“GDPR”). The question before the CJEU is whether consumer interest groups can bring a collective action for breach of the GDPR on behalf of data subjects, regardless of whether an individual data subject’s concrete rights have been violated and without a mandate from the data subject.
De la Tour is of the opinion that not only entities whose sole purpose is the protection of personal data can bring an action. Pursuing an interest related to the protection of personal data, as a consumer protection association does, is sufficient (par. 61). It is furthermore not required that an entity should identify in advance one or more persons affected by the processing. It is sufficient that the processing entailed an infringement of the GDPR (par. 62-63). In interpreting Article 80(2) GDPR, the main focus is on the effectiveness of the GDPR and the protection of the rights of data subjects (par. 64, 67, 73-78, 81 & 83-84). According to De la Tour, collective actions are particularly suited to the objective of establishing a high level of protection of personal data (par. 76-78). Among other things, the provision therefore allows Member States a great deal of leeway to implement the article in a way that allows entities to bring collective actions without a mandate from the data subjects (par. 69-75; also see par. 54 on the optional nature of the provision).
The CJEU is expected to deliver judgment on 28 April 2022.