On April 28, 2022, the European Court of Justice ruled in response to a request for a preliminary ruling from the Federal Court of Justice that, contrary to the previous legal situation in Germany, actions brought by associations against data protection violations are also admissible if a violation of the rights of specific individuals has not been established and there is no corresponding order to bring an action before a civil court by injured individuals. It is therefore sufficient that the practice complained of merely violates applicable data protection regulations in the abstract, without a specific person whose rights have been individually violated and has given rise to the filing of an action. The BGH had doubts about this and considered it possible for the supervisory authorities to have exclusive authority to prosecute data protection violations.
The ECJ has now expressly clarified that the legal standing of associations does not require an individual infringement of a data subject or their commissioning and that, according to the GDPR, the public interest in punishing data protection infringements is sufficient in this respect.
Your contact persons in the data protection team will be happy to answer your questions
Yvonne Quad
quad@tigges.legal
+49 211 8687 137
Matthias Klagge, LL.M.
klagge@tigges.legal
+49 211 8687 134
Sebastian Keilholz, LL.M.
keilholz@tigges.legal
+49 211 8687 153
Dr. Thomas Riemann
riemannn@tigges.legal
+49 211 8687 168
