The First Civil Senate of the Federal Court of Justice, which is responsible for competition law among other things, has to decide whether a breach by the operator of a social network of the obligation under data protection law to inform the users of this network about the scope and purpose of the collection and use of their data justifies claims for injunctive relief under competition law and can be pursued by consumer protection associations in an action before the civil courts.
The Federal Court of Justice stayed the proceedings and referred the question to the Court of Justice of the European Union for a preliminary ruling as to whether the provisions of Chapter VIII, in particular Art. 80 para. 1 and 2 and Art. 84 para. 1 of Regulation (EU) 2016/679 (General Data Protection Regulation) preclude national provisions which – in addition to the powers of intervention of the supervisory authorities responsible for monitoring and enforcing the regulation and the legal protection options of the data subjects – grant competitors on the one hand and associations, bodies and chambers authorized under national law on the other hand the power to take action against the infringer before the civil courts for infringements of the General Data Protection Regulation, irrespective of the infringement of specific rights of individual data subjects and without the mandate of a data subject.
This question is disputed in the case law of the lower courts and in legal literature. It is argued that the General Data Protection Regulation contains an exhaustive regulation for the enforcement of the data protection provisions set out in this regulation and that associations therefore only have the right to bring an action under the conditions of Art. 80 of the General Data Protection Regulation, which were not met in the case in question.
Others do not consider the provisions on legal enforcement in the General Data Protection Regulation to be conclusive and therefore continue to consider associations to be authorized to enforce claims for injunctive relief due to the violation of data protection provisions by way of an action before the civil courts, irrespective of the violation of specific rights of individual data subjects and without a mandate from a data subject.
The Court of Justice of the European Union has already ruled that the provisions of Directive 95/46/EC (Data Protection Directive) – which was in force until the General Data Protection Regulation entered into force on May 25, 2018 – do not preclude associations from bringing an action (judgment of July 29, 2019 – C-40/17). However, it is not clear from this decision whether this right of action continues to exist under the General Data Protection Regulation that replaced the Data Protection Directive (BGH, decision of May 28, 2020; case reference: I ZR 186/17; press release of the BGH of May 28, 2020).