If you also asked yourself this question at least once… we give you the answer.
After years of litigation by the Federation of German Consumer Organisations against Meta (formerly Facebook), the ECJ has finally delivered its long-awaited judgement.
The German Federation of Consumer Organisations (vzbv) has been taking action against the social network Facebook for years. The association is of the opinion that Facebook does not provide sufficient information about which user data is passed on and what happens with it.
In May 2020, the Federal Court of Justice (BGH) referred the question to the European Court of Justice (ECJ) whether a breach by the operator of a social network of the obligation under data protection law to inform the users of this network about the scope and purpose of the collection and use of their data gives rise to claims for injunctive relief under competition law and whether breaches of the General Data Protection Regulation (GDPR) may be asserted by a consumer protection association at all (decision of 28 May 2020, ref. I ZR 186/17).
The ECJ has now answered this question. Such actions could be brought independently of the concrete violation of the right of a data subject to the protection of his or her data and without a corresponding order (judgment of 28 April 2022, Case C-319/20).
The ECJ thus endorsed the opinion of the Advocate General of the ECJ, according to which member states may allow consumer protection associations to bring collective actions against violations of the protection of personal data if the actions are based on violations of rights which data subjects derive directly from the GDPR.