Court decision · 28 April 2022
Meta Platforms Ireland Ltd v Bundesverband der Verbraucherzentralen
Case C-319/20, ECLI:EU:C:2022:322 · Court of Justice of the European Union (Grand Chamber)
What it means for your code
Data protection exposure is not limited to regulator fines and individual claims; a consumer body can litigate a design decision on behalf of an entire user base.
What happened
A German consumer association sued over free games on a social platform that passed player data to third parties, without acting on any individual's mandate.
What was decided
Member States may allow consumer associations to bring representative actions for infringements of data protection rights without a mandate from a specific data subject, where the alleged breach also affects consumer protection or unfair-terms rules.
The legal test applied
- Art. 80(2) permits Member States to give consumer associations standing without a mandate
- The action must concern rights the subject enjoys under the GDPR and may be combined with consumer-law claims
What would have changed the outcome
- A purely contractual complaint with no data protection dimension falls outside
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.