DPIA

The wait is over
Ailance™ DPIA is here!

Data protection breach as anti-competitive behavior: BGH confirms legal standing for consumer protection associations

Following the ECJ, the Federal Court of Justice has now also ruled that consumer protection associations can also take legal action against data protection violations.
Categories:

The First Civil Senate of the Federal Court of Justice, which is responsible for competition law among other things, has clarified that breaches of the data protection information obligations of the General Data Protection Regulation (GDPR) can also constitute a breach of competition law. This means that a qualified institution such as the consumer advice center or other consumer protection associations can take civil action against data protection violations.

Data protection deficits in Facebook's "App Center"

The defendant, Meta Platforms Ireland Ltd, operates the social network "Facebook". In one area of the platform, the so-called "App Center", the defendant makes third-party games available to its users. In November 2012, several games were offered there with a "Play now" button. Directly below this button were instructions such as: "By clicking on 'Play game' above, this application will receive: Your general information, Your email address, About you, Your status messages." It also explained that the application could "post on your behalf" - including scores, status updates, photos and more.

This information was criticized as inadequate by the plaintiff, the Federation of German Consumer Organizations (vzbv). In particular, users were not informed clearly and comprehensibly about the type, scope and purpose of the processing of their personal data. In addition, the blanket reference to the possibility of publishing content on behalf of users constituted an unreasonable disadvantage and was therefore to be qualified as invalid general terms and conditions. The vzbv then brought an action for an injunction.

Legal standing for consumer protection associations?

After the Court of Appeal upheld the action, the BGH stayed the proceedings and referred several questions on the interpretation of Art. 80 (2) GDPR to the Court of Justice of the European Union (CJEU) for a preliminary ruling. The background to this was, in particular, the question of whether consumer protection associations are entitled to assert data protection violations in court without having to be commissioned by data subjects or specified in individual cases. The ECJ was asked to clarify whether such a right of action is compatible with the GDPR, in particular with regard to collective legal protection in data protection law.

The ECJ has answered these questions in two judgments: On April 28, 2022 in Case C-319/20 (Meta Platforms Ireland I) and on July 11, 2024 in Case C-757/22 (Meta Platforms Ireland II). In both decisions, the ECJ confirmed that qualified entities - such as consumer associations - are entitled to pursue infringements of the General Data Protection Regulation in court under Art. 80 (2) GDPR, irrespective of an individual mandate from data subjects. It is sufficient that the action is brought in the interest of protecting the rights and freedoms of natural persons and relates to sufficiently specific data processing. It is not necessary for individuals to be specifically affected. This paved the way for effective collective redress in data protection law at European level.

Reading tip: BGH confirms claim for injunctive relief under competition law following GDPR infringement when ordering medicines online

Consumer protection associations as qualified institutions

The Federal Court of Justice dismissed the defendant's appeal in its entirety and emphasized several key principles for the assessment under data protection and competition law in its decision:

On the one hand, the Federal Court of Justice expressly confirmed the right of the Federation of German Consumer Organizations to take legal action in accordance with Art. 80 para. 2 GDPR in conjunction with Section 8 para. 3 no. 3 UWG, Section 3 para. 1 sentence 1 no. 1 UKlaG and Section 1 UKlaG. Accordingly, qualified institutions can also take action against data protection violations without an individual mandate from data subjects, provided that these are sufficiently specific and likely to adversely affect consumer interests. The representative action is already admissible if a group of persons - such as the users of a platform - can be determined in the abstract and a systematic breach of the GDPR can be assumed.

Secondly, the court clarified that the data protection information obligations under Art. 12 para. 1 sentence 1 and Art. 13 para. 1 lit. c and e GDPR are not only decisive for the effectiveness of consent, but also constitute a market conduct regulation relevant under unfair competition law. A breach of these obligations may also constitute unfair conduct within the meaning of Section 3a UWG or a breach of Section 5a UWG (withholding of material information).

Thirdly, the BGH emphasized the particular importance of these information obligations in data-driven business models. As users often do not "pay" with money, but with their personal data, the transparency of data processing plays a decisive role in consumers' freedom of choice. If this information is missing, consent to data processing is not only invalid, but can also be challenged under competition law.

Fourthly, the court confirmed that the blanket permission for an app to post "status messages, photos and more" on behalf of the user constituted an unreasonable disadvantage within the meaning of Section 307 BGB. The clause is intransparent and surprising due to the insufficient information content. Its use could therefore also be prohibited in accordance with Section 1 UKlaG.

Practical implications of the BGH ruling

One of the key effects of the ruling is the confirmation of the active legal standing of consumer associations under Art. 80 para. 2 GDPR: These can now take action without a specific individual case and without an individual mandate: Provided there is a structural breach of the GDPR that potentially affects a large group of users. This enables the associations to take action against data protection violations. Especially in cases where the data subjects themselves do not recognize the infringement or cannot assert it due to asymmetrical information relationships. This strengthens the collective enforcement of data protection law.

For companies - especially those with data-based business models - there is a need for action as a result of the ruling. The requirements for transparency, comprehensibility and completeness of data protection notices continue to increase. Companies must ensure that users are informed about the collection, processing, transfer and purpose of their personal data in understandable language, at the earliest possible stage and comprehensively. The legal basis as well as the recipients and the duration of storage must be presented transparently.

Violations of these obligations not only have consequences under data protection law, for example through measures by the supervisory authorities under Art. 58 GDPR and fines under Art. 83 GDPR. They can now also be punished under competition law. The risk of civil injunctions by associations increases considerably. At the same time, ineffective clauses in terms of use or general terms and conditions will also be easier to challenge if they have data protection deficits or unreasonably disadvantage consumers.

Last but not least, the ruling also brings the effectiveness of consent more into focus. Consent is only effective if it is based on prior, comprehensive and transparent information. Otherwise, it is not only ineffective under data protection law, but can also be sanctioned as a breach of competition law.

Data protection is not only a regulatory requirement, but increasingly also a compliance requirement under civil law and the market economy. Companies should critically review and adapt their information and consent processes in light of this decision.

Source: Press release on the BGH ruling I ZR 186/17 of March 27, 2025

Tags:
Share this post :
en_USEnglish