On April 28, 2022, the Court of Justice of the EU (“CJEU”) decided that consumer protection associations may bring collective claims without a mandate from the affected consumers, including for violations of the GDPR, relying on national consumer law provisions. The words “without a mandate” refers to the fact that the organization is not representing a particular consumer or group of consumers, rather, it is representing the collective interests of those whose personal data have been processed in a manner contrary to the GDPR, without naming particular data subjects.
The CJEU was asked by a German court whether a consumer organization could rely on a consumer law provision allowing collective claims without a mandate, in order to seek an injunction for violations of the GDPR. According to the CJEU, this is compatible with Article 80(2) of the GDPR. However, the CJEU pointed out that consumer organizations may only initiate collective claims without a mandate where this option is provided for under EU Member State law.
The CJEU clarified that where that is the case, it is sufficient if the consumer organization:
- identifies the category or group of data subjects affected by the processing; and
- demonstrates that the data processing that infringes the GDPR is likely to affect the data subjects’ rights under the GDPR, without needing to prove actual harm suffered by a data subject.
Finally, the CJEU emphasized that an infringement of the GDPR may at the same time give rise to an infringement of EU rules on consumer protection for unfair commercial practices. It is probably not a coincidence that in less than a month (on May 28, 2022), the new EU consumer protection rules will begin to apply. These new rules aim to ensure effective and harmonized enforcement by setting maximum fines of at least 4% for widespread infringements that affect consumers in several EU Member States. Member States will be able to provide for higher maximum fines.
* * *
The team at Covington has gathered extensive expertise in EU data privacy law and EU consumer law and is well-positioned to provide advice on both laws.