Data protection breach as anti-competitive behavior: BGH confirms legal standing for consumer protection associations

Following the ECJ, the Federal Court of Justice has now also ruled that consumer protection associations can also take legal action against data protection violations.
Categories:

The First Civil Senate of the Federal Court of Justice, which is responsible for competition law among other things, has clarified that breaches of data protection law Duty to inform of the General Data Protection Regulation (GDPR) can also constitute a breach of competition law. This means that a qualified institution such as the consumer advice center or other consumer protection associations can take civil action against data protection violations.

Data protection deficits in Facebook's "App Center"

The defendant, Meta Platforms Ireland Ltd, operates the social network "Facebook". In one area of the platform, the so-called "App Center", the defendant makes third-party games available to its users. In November 2012, several games were offered there with a "Play now" button. Directly below this button were instructions such as: "By clicking on 'Play game' above, this application will receive: Your general information, Your email address, About you, Your status messages." It also explained that the application was allowed to "post on your behalf" - including scores, status messages, Photos and more.

This information was criticized as inadequate by the complaining Federation of German Consumer Organizations (vzbv). In particular, users were not informed clearly and comprehensibly about the type, scope and purpose of the Processing of their personal data. In addition, the blanket reference to the possibility of publishing content in the name of the users constituted an unreasonable disadvantage and was therefore to be qualified as invalid general terms and conditions. The vzbv then brought an action for an injunction.

Legal standing for consumer protection associations?

After the Court of Appeal had upheld the action, the BGH stayed the proceedings and referred several questions to the Court of Justice of the European Union (CJEU) on the interpretation of Art. 80 (2) of the German Civil Code. GDPR for a preliminary ruling. The background to this was, in particular, the question of whether consumer protection associations are entitled to assert data protection violations in court without having to be commissioned by data subjects or specified in individual cases. The ECJ was asked to clarify whether such a right of action is compatible with the GDPR in particular with regard to collective legal protection in data protection law.

The ECJ has answered these questions in two judgments: On April 28, 2022 in Case C-319/20 (Meta Platforms Ireland I) and on July 11, 2024 in Case C-757/22 (Meta Platforms Ireland II). In both rulings, the ECJ confirmed that qualified entities - such as consumer associations - are entitled under Art. 80 para. 2 GDPR are entitled to pursue violations of the General Data Protection Regulation in court, irrespective of an individual mandate from data subjects. It is sufficient that the action is brought in the interest of protecting the rights and freedoms of natural persons and relates to sufficiently specific data processing. It is not necessary for individuals to be specifically affected. This paved the way for effective collective redress in data protection law at European level.

Reading tip: BGH confirms claim for injunctive relief under competition law following GDPR infringement when ordering medicines online

Consumer protection associations as qualified institutions

The Federal Court of Justice dismissed the defendant's appeal in its entirety and emphasized several key principles for the assessment under data protection and competition law in its decision:

On the one hand, the Federal Court of Justice expressly confirmed the standing of the Federation of German Consumer Organizations under Art. 80 para. 2 GDPR in conjunction with Section 8 (3) no. 3 UWG, Section 3 (1) sentence 1 no. 1 UKlaG and Section 1 UKlaG. Accordingly, qualified institutions can also take action against data protection violations without an individual mandate from the data subject, provided that these are sufficiently specific and likely to harm consumer interests. The Collective action is already permissible if a group of persons - such as the users of a platform - can be determined in the abstract and a systematic Infringement against the GDPR is to be assumed.

Secondly, the court made it clear that the data protection regulations Duty to inform from Art. 12 para. 1 sentence 1 and Art. 13 para. 1 lit. c and e GDPR not only for the effectiveness of a Consent but also constitute a market conduct regulation relevant under fair trading law. A Infringement against these obligations may also constitute unfair conduct within the meaning of Section 3a UWG or a Infringement against § 5a UWG (withholding of material information).

Thirdly, the BGH emphasized the special importance of these Duty to inform in data-driven business models. As users often do not "pay" with money, but with their personal data, the Transparency The data processing has a decisive role to play in consumers' freedom of choice. If this information is missing, the Consent in data processing is not only ineffective, but can also be challenged under competition law.

Fourthly, the court confirmed that the blanket permission for an app to send "status messages, Photos and more" constitutes an unreasonable disadvantage within the meaning of Section 307 BGB. The clause is intransparent and surprising due to the insufficient information content. Its use could therefore also be prohibited in accordance with Section 1 UKlaG.

Practical implications of the BGH ruling

One of the key effects of the ruling is the confirmation of the active legal standing of consumer associations under Art. 80 para. 2 GDPRThese can now take action without a specific individual case and without an individual mandate: If a structural Infringement against the GDPR that potentially affects a large group of users. This enables the associations to take action against data protection violations. Especially in cases where the data subjects themselves do not recognize the infringement or cannot assert it due to asymmetrical information relationships. This strengthens the collective enforcement of data protection law.

For companies - especially those with data-based business models - there is a need for action as a result of the ruling. The requirements for TransparencyThe comprehensibility and completeness of data protection notices continue to increase. Companies must ensure that users are informed about the collection of their data, Processing, Transmission and the purpose of their personal data in understandable language, at the earliest possible time and comprehensively. Both the Legal basis as well as the recipients and the duration of storage in a transparent manner.

Violations of these obligations not only have consequences under data protection law, for example through measures taken by the supervisory authorities in accordance with Art. 58 GDPR and fines pursuant to Art. 83 GDPR. They can now also be punished under competition law. The risk of civil injunctions by associations increases considerably. At the same time, ineffective clauses in terms of use or general terms and conditions are also easier to challenge if they have data protection deficits or unreasonably disadvantage consumers.

Last but not least, the ruling also brings the effectiveness of consent more into focus. One Consent is only effective if it is based on prior, comprehensive and transparent information. Otherwise, it is not only ineffective under data protection law, but can also be considered a breach of competition law. Infringement be sanctioned.

Data protection is not only a regulatory requirement, but increasingly also a civil law and market economy compliance requirement. Companies should critically review and adapt their information and consent processes in light of this decision.

Source: Press release on the BGH ruling I ZR 186/17 of March 27, 2025

Tags:
Share this post :