CJEU: Consumer associations can bring data protection representative actions independently

The Court of Justice of the European Union (CJEU) judgment in case C-319/20 Meta Platforms Ireland states that consumer protection associations may bring representative actions independently without the mandate of individual consumers.

In this case involving Germany’s Federal Union of Consumer Organisations and Associations, the Court states that certain provisions of the GDPR make it possible for Member States to lay down additional rules, provided that the national rules adopted do not undermine the content and objectives of the GDPR.

The Federal Union is a body that pursues the public interest objective of safeguarding the rights of consumers, and is therefore allowed to represent individuals in this manner.