Consumer protection organizations should soon get the green light from the Federal Court of Justice (BGH) to go to court because of possible data protection violations by companies – even if there are no specific victims. However, there could be conditions for this, for example that allegedly harmed consumers are also identifiable. This is how it crystallized on Thursday at a hearing in Karlsruhe, in which the Federal Association of Consumers is taking action against Facebook.
It is still unclear when the BGH will deliver its verdict (Az. I ZR 186/17). The decision on associations’ right to sue is important for a “plenty of proceedings” pending in the courts, said the representative of consumer protection groups, BGH lawyer Peter Wassermann.
The violations warned of in the specific case concern the fact that free games from third-party providers were presented in the “App Center” of Facebook, in which users, at least in the 2012 version, clicked on “Play immediately” to transmit various data to the game operators would have agreed. For one game, the notices ended with the phrase, “This application may post status updates, photos, and more on your behalf.” Courts in Berlin agreed with the consumer advocates.
The BGH lawyer for Facebook, Christian Rohnke, said that of course the defendant had changed this handle in the meantime. “We’re ten years ahead.” According to the presiding judge of the first civil senate, Thomas Koch, Facebook has meanwhile issued a statement that it will refrain from doing so. However, negotiations continued in order to have a final verdict on the rights of consumer protection organizations in Germany to take legal action independently of the users affected.
European Court of Justice gave the green light for associations
The BGH had asked the European Court of Justice (ECJ) for advice as to whether the association’s legal standing violated the European General Data Protection Regulation (GDPR). The judges in Luxembourg ruled in April that associations entitled under national law could go to court instead of users in the event of data protection violations by Internet giants – even without a specific order from those affected.
Two other cases negotiated on Thursday deal with the question of whether a company’s competitors – specifically pharmacists – are also entitled to sue in data protection cases. The ECJ had not commented on this at the time. The Senate may therefore ask its colleagues in Luxembourg more questions. It is not yet clear when he will make a decision. (Az. I ZR 222/19 and others)
