The First Civil Senate of the Federal Court of Justice, which is responsible for competition law among other things, has to decide whether a breach by the operator of a social network of the obligation under data protection law to inform the users of this network about the scope and purpose of the collection and use of their data justifies claims for injunctive relief under competition law and can be pursued by consumer protection associations in an action before the civil courts.
The Federal Court of Justice stayed the proceedings and referred the question to the Court of Justice of the European Union for a preliminary ruling as to whether the provisions of Chapter VIII, in particular Article 80(1) and (2) and Article 84(1) and (2) and Article 84(2) of the EC Treaty, are applicable to the application of the principle of equal treatment. 1 of Regulation (EU) 2016/679 (General Data Protection Regulation) are contrary to national provisions which – in addition to the powers of intervention of the supervisory authorities responsible for monitoring and enforcing the Regulation and the legal protection options of the data subjects – grant competitors on the one hand and associations, institutions and chambers authorized under national law on the other hand the power to take action against the infringer before the civil courts for violations of the General Data Protection Regulation, irrespective of the violation of specific rights of individual data subjects and without the mandate of a data subject.
This question is disputed in the case law of the lower courts and in legal literature. It is argued that the General Data Protection Regulation contains an exhaustive regulation for the enforcement of the data protection provisions laid down in this Regulation and that associations therefore only have the right to bring an action under the conditions of Art. 80 of the General Data Protection Regulation, which were not met in the case in question.
Others do not consider the provisions on legal enforcement in the General Data Protection Regulation to be conclusive and therefore continue to consider associations to be authorized to enforce claims for injunctive relief due to the violation of data protection provisions by way of an action before the civil courts, irrespective of the violation of specific rights of individual data subjects and without a mandate from a data subject.
The Court of Justice of the European Union has already ruled that the provisions of Directive 95/46/EC (Data Protection Directive) – which was in force until the General Data Protection Regulation entered into force on May 25, 2018 – do not preclude associations from bringing an action (judgment of July 29, 2019 – C-40/17). However, it is not clear from this decision whether this right of action continues to exist under the General Data Protection Regulation that replaced the Data Protection Directive (BGH, decision of May 28, 2020; case reference: I ZR 186/17; press release of the BGH of May 28, 2020).
