LUXEMBOURG (CN) — Ruling against Facebook's parent company Meta, the European Court of Justice found on Thursday that Germany’s consumer protection association can sue the social media giant for privacy breaches.
The Federal Court of Justice in Germany, the Bundesgerichtshof, asked the European Union's highest court to clarify whether consumer groups are eligible to bring complaints against tech companies under the EU's 2018 General Data Protection Regulation, or if that right was limited to national data protection agencies.
The Luxembourg-based court wrote that the Federation of German Consumer Organizations and Associations can bring proceedings because “it pursues a public interest objective consisting in safeguarding the rights and freedoms of data subjects in their capacity as consumers." Meta had argued the GDPR legislation limited who could initiate legal challenges to the government organization tasked with safeguarding personal information online.
Known by its German acronym VZBV, the consumer group accused Meta in 2013 of violating both data protection and competition regulations by making third-party games available for free and then failing to safeguard the data those games collected. By clicking the “play now” button in games like Scrabble on Facebook, players consented to give their personal data to the games’ third-party creators. The VZBV accused Meta Platforms Ireland - then called Facebook Ireland - of failing to provide sufficient information to European users about how that data was being shared.
The German court found the complaint credible but was unsure if the nonprofit organization had standing. The EU court ruled it does.
“The GDPR is a crucial law that protects people’s personal data in the EU. It is essential that it is better enforced, and rulings like today’s will help,” said Ursula Pachl, deputy director general of the European Consumer Organization, an umbrella consumers' group that includes the VZBV, in a statement.
The ruling against Meta was forecast in a nonbinding opinion last year from an advocate general for the Court of Justice, Jean Richard de la Tour, who wrote, “In the modern economy, marked by the boom in the digital economy, … it is increasingly common for consumer protection associations to initiate actions for the protection of consumer rights and to the combat against unfair commercial practices.”
The VZBV heralded Thursday's decision in part because it says privacy issues have been so widespread that government agencies are overwhelmed.
“It is an open secret that some European data protection authorities are not quite able to cope with the escalating data collection of the big technology companies,” VZBV board member Jutta Gurkmann said in a statement.
Meta said in a statement that it will "review the decision and assess its implications." The social media giant, which had more than $80 billion in revenue last year, has lost a series of cases before the Court of Justice over data privacy. In 2021, the court held that all member states are allowed to bring privacy complaints against companies, regardless of where they are headquartered, opening the door to this latest complaint. Meta had argued it should only have to face lawsuits in Ireland, home of its European headquarters.
Follow @mollyquell
Subscribe to Closing Arguments
Sign up for new weekly newsletter Closing Arguments to get the latest about ongoing trials, major litigation and hot cases and rulings in courthouses around the U.S. and the world.
