Supreme Court doubts consumer protection associations’ legal standing to sue for GDPR violations

Published 21/01/2021

Like the German Federal Supreme Court BGH (28.5.2020, I ZR 186/17; see ECJ C-319/20), the Austrian Supreme Court OGH now apparently also has doubts about whether consumer protection associations (in the case at hand, the Association for Consumer Information [VKI]) are authorised to take up data protection violations in General Terms and Conditions (GTCs) within the framework of association proceedings pursuant to Section 28 of the Consumer Protection Act. The OGH has therefore (25.11.2020, 6 Ob 77/20x ) submitted the same questions as the German BGH to the ECJ (see C-701/20). The question arises of whether the GDPR precludes national regulations that grant consumer protection associations the power to take action against companies for using general terms and conditions that violate the GDPR.
It is noteworthy that the OGH – like the BGH (Scharf/Staber, ecolex 2020, 909) – also includes the question of the legal standing of competitors under the Unfair Competition Act in its submission, although this is not relevant for the case at hand. Recently, another senate of the OGH denied the general legal standing of third parties in the case of data protection violations – and thus probably also of consumer protection associations – due to the highly personal nature of data protection law (Staber/Scharf, NetV 2020, 56). However, the issue there was not the use of unlawful GTCs.
The ECJ’s decision is eagerly awaited. There are very good arguments that consumer protection associations do not have the standing to take legal action against companies for data protection violations.

Contact us if you are confronted with allegations of using unlawful GTCs or consent declarations due to violations of the GDPR.