Do consumers associations have standing to file data protection infringement claims?

In August, the Austrian Supreme Court (OGH) suspended proceedings brought by a consumers association (6Ob48/21h) until the Court of Justice of the European Union (CJEU) issues a preliminary ruling on a question referred by the OGH in the framework of previous proceedings to establish whether consumers associations have standing to file court claims when consumers’ data protection rights are infringed.

The case was opened by the Consumer's Information Association (Verein für Konsumenteninformation) when it filed a class action against an Austrian mail order company because its terms of business contained abusive clauses in relation to financing users’ purchases.

The Association claimed that the clauses were abusive because: (i) they lacked transparency, and (ii) they breached several provisions of the General Data Protection Regulation (RGPD). With regard to the infringement of the data protection regulations, the Association claimed that the platform’s terms of business did not respect the GDPR’s principles of transparency and information, and they breached article 22 by making automated decisions based on unidentified external credit ratings.

On August 14, 2020, the Salzburg Regional Court handed down a judgment at first instance dismissing the Association’s claims because consumers associations lacked standing to file claims, unless they did so representing specific individuals who had been affected by the data protection infringement. This reasoning was fully upheld by the Linz Regional High Court in its appeal judgment dated November 26, 2020.

The proceedings were then escalated to the OGH, which, breaking away from the previous rulings, has suspended the proceedings brought by the Association until the CJEU issues a preliminary ruling answering the question referred by the OGH in previous proceedings (6Ob77/20x), on November 25, 2020, as it has a direct impact on these proceedings. In particular, the CJEU must rule on the practical application of articles 80 and 84 of the GDPR and on whether consumers associations authorized under domestic law can hold standing to file class actions for GDPR breaches, regardless of whether there are individuals directly affected by those breaches and based solely on consumer or user protection or unfair competition regulations.

The CJEU has not yet issued its preliminary ruling. However, whatever its position, this ruling will have a broad impact on data protection and consumption matters and class actions under European law.

We will keep you informed and report the CJEU’s ruling and any other developments in this area in our blog.