Standing of Consumer Organizations in Data Protection Representative Actions
In 2018, the General Data Protection Regulation (GDPR)2 introduced a representative actions mechanism in data protection cases. One of the pressing issues related to the application of this mechanism is its interaction with already existing representative actions mechanisms under EU Member States' consumer, unfair commercial practices and unfair contract terms laws. In its landmark preliminary ruling of 28 April 2022, the Court of Justice of the European Union (CJEU) clarified that the GDPR affords a wide margin of appreciation for EU Member States to implement the representative actions mechanism introduced by the GDPR in their domestic law. In the case at issue, the Court concluded that pre-GDPR legislation allowing a consumer organization to bring a representative action for an injunction without a mandate and independently of infringement of specific rights is within the scope of that margin of appreciation, even when such claim is brought on the basis of a domestic consumer, unfair commercial practices or unfair contract terms law. It is important, however, that a violation that gave rise to the claim is liable to affect the rights of data subjects derived from the GDPR.
