The number of actions to enforce the European Union’s General Data Protection Regulation (GDPR) against a wide range of companies continues to rise. Germany, a country where privacy enjoys strong legal protection, is establishing itself as a favorite jurisdiction for enforcement of the GDPR. And, not surprisingly, Facebook is one of the companies in the crosshairs.
Last February, Germany’s Federal Cartel Office held that Facebook’s practice of combining data it collects across its suite of products, which include WhatsApp and Instagram, is anticompetitive, and ordered Facebook to stop. That ruling was later overturned on appeal. Last month (Jan. 2020), a state court in Berlin, assessing Facebook’s terms of service, determined that Facebook had violated the GDPR’s requirement that “informed consent” by a data subject be given before his or her personal information is collected.
Interestingly, this latest action against Facebook was brought by a consumer group, the Federation of German Consumer Organizations. While this regional interpretation of the GDPR’s provisions regarding informed consent should be considered, the real impact may be reliance on this decision by consumer groups and other organizations to establish standing to seek legal enforcement of the GDPR without the involvement of an injured or affected data subject.
We will see how this state court ruling fares on review in Germany, and how, ultimately, other jurisdictions in the EU come out on this important issue of standing. The standing provision of the CCPA has already been a challenge and the subject of debate. As more states in the U.S. craft and pass privacy legislation, we can expect much debate and, most likely, litigation around this important issue.