DATA PROTECTION
EU Court of Justice: failure to provide privacy information notice is a breach entitling representative associations to bring actions - even without a mandate from the data subject - under Article 80(2) GDPR.
The Bundesgerichtshof (Federal Court of Justice, Germany) referred a question to the CJEU for a preliminary ruling on the interpretation of Article 80(2) of the GDPR. According to that provision, Member States may provide that a body, organisation or association, irrespective of the mandate given by the data subject, has the right to lodge a complaint with the supervisory authority in the Member State in question, pursuant to Article 77 of the GDPR, and to exercise the rights provided for in Articles 78 and 79 thereof, if it considers that the rights enjoyed by a data subject under that regulation have been infringed as a result of ‘the processing of personal data’.
The reference for a preliminary ruling was made in the context of a dispute in Germany between Meta and the Federal Union of German Consumer Organisations and Associations concerning Meta Platforms Ireland's alleged infringement of the German legislation on the protection of personal data, which constitutes, at the same time, an unfair commercial practice, an infringement of a consumer protection law and a breach of the prohibition on the use of invalid general terms and conditions.
In that action, the referring court expressed doubts as to the admissibility of the Federal Union's action. It wondered, in particular, whether the Federal Union's legal standing could derive from Article 80(2) of the GDPR even in the case of a mere failure by the controller to provide information about the processing pursuant to Articles 12 and 13 of the GDPR. That is why it referred a question to the CJEU for a preliminary ruling on the interpretation of that provision.
The CJEU concluded that Article 80(2) of the HGDPR must be interpreted as meaning that the condition that a qualified entity, in order to bring a representative action under that provision, must allege that a data subject's rights under that regulation have been infringed ‘as a result of the processing’, within the meaning of that provision, is satisfied where that entity alleges that the infringement of that person's rights occurs ‘as a result of the processing’ of personal data and that it results from the controller's failure to fulfil its obligations under Article 12 first sentence of Article 12(1) and of Article 13(1)(c) and (e) of that regulation, to communicate to the person concerned by that processing of data, in a concise, transparent, intelligible and easily accessible form, in plain and intelligible language, the information relating to the purpose of that processing of data and to the recipients of those data, at the latest at the time of the collection of those data.
The reference for a preliminary ruling was made in the context of a dispute in Germany between Meta and the Federal Union of German Consumer Organisations and Associations concerning Meta Platforms Ireland's alleged infringement of the German legislation on the protection of personal data, which constitutes, at the same time, an unfair commercial practice, an infringement of a consumer protection law and a breach of the prohibition on the use of invalid general terms and conditions.
In that action, the referring court expressed doubts as to the admissibility of the Federal Union's action. It wondered, in particular, whether the Federal Union's legal standing could derive from Article 80(2) of the GDPR even in the case of a mere failure by the controller to provide information about the processing pursuant to Articles 12 and 13 of the GDPR. That is why it referred a question to the CJEU for a preliminary ruling on the interpretation of that provision.
The CJEU concluded that Article 80(2) of the HGDPR must be interpreted as meaning that the condition that a qualified entity, in order to bring a representative action under that provision, must allege that a data subject's rights under that regulation have been infringed ‘as a result of the processing’, within the meaning of that provision, is satisfied where that entity alleges that the infringement of that person's rights occurs ‘as a result of the processing’ of personal data and that it results from the controller's failure to fulfil its obligations under Article 12 first sentence of Article 12(1) and of Article 13(1)(c) and (e) of that regulation, to communicate to the person concerned by that processing of data, in a concise, transparent, intelligible and easily accessible form, in plain and intelligible language, the information relating to the purpose of that processing of data and to the recipients of those data, at the latest at the time of the collection of those data.
