On March 27, 2025, the Federal Court of Justice (BGH) titled its press release (No. 059/2025) as follows:

"Consumer protection associations and competitors are authorized to pursue violations of data protection law by way of competition law claims before civil courts."

With this announcement, the BGH covers decisions in several proceedings – BGH, judgments of March 27, 2025 - I ZR 186/17 as well as I ZR 222/19 and I ZR 223/19. These judgments are not entirely surprising, as they incorporate the European Court of Justice's (ECJ) answers to questions referred by the BGH into German case law.

Let’s take a quick step back: What are the facts behind this press release?

Standing of consumer protection associations to sue for data protection violations

After more than ten years, the proceedings brought by the Federation of German Consumer Organizations against Meta Platforms Ireland Limited (then Facebook Ireland Limited) have come to an end with the BGH's decision (judgment of March 27, 2025 - I ZR 186/17). It all began quite unspectacularly with a default judgment by the Berlin Regional Court on September 9, 2013 (16 O 60/13) – at that time still under the old legal framework. In this, the Berlin Regional Court ruled:

"The link between the 'Play Game' button and consent to unlimited data transfer proves to be misleading under Section 5 of the Act Against Unfair Competition (UWG), because the defendant gives the user the impression that their consent is effective, while in truth this is not the case; since the user does not know the scope of their declaration, they cannot make an informed decision regarding the disclosure of their personal data. The requirements for effective consent under Section 4a of the Federal Data Protection Act (BDSG) and Section 13(2) of the Telemedia Act (TMG) are not met. By deceiving the user about the legal validity of their declaration, they are simultaneously deterred from asserting their rights, at least retroactively."

With this, the Regional Court responded to a practice on the Facebook platform where Facebook users were provided with free third-party games via an "App Center" link, among other things. By clicking the "Play Game" button, the user consented to the transmission of various data to the third-party provider, with the scope of the data transmission being insufficiently indicated below the button.

A lot has happened since that first (default) judgment: The default judgment was upheld, and the parties continuously pursued the legal process up to the Federal Court of Justice (BGH); see the procedural history in the overview below. The BGH stayed the proceedings twice and referred questions to the ECJ in 2020 and 2022 regarding the interpretation of Article 80 of the EU General Data Protection Regulation (GDPR), which has been directly applicable in EU member states since May 2018.

What did the ECJ decide?

1. ECJ ruling of April 28, 2022 (C-319/20)

Due to changes in the law since the action was filed, in particular the entry into force of the GDPR, the Federal Court of Justice (BGH) had doubts as to whether the federal association still had standing to sue and stayed the proceedings. Regarding the referred question, the ECJ ruled that the federal association, as a qualified entity within the meaning of Section 4 of the German Injunctions Act (UKlaG), had standing to sue in this case. In doing so, the ECJ established the following principles:

· an association for the protection of consumer interests can meet the requirements of a body within the meaning of Article 80(1) of the GDPR ;

· there is no need for a specific infringement of the data protection rights of a data subject to be asserted;

· an action can be brought without a mandate from a data subject

·       on the groundsthat a breach of the prohibition on unfair commercial practices, a breach of a consumer protection law or a use of invalid general terms and conditions were present, may be brought, 

· provided that the data processing in question in the association's view impairs the data protection rights of identified or identifiable natural persons.

2. ECJ judgment of 11 July 2024 (C-757/22)

In the subsequent judgment, the ECJ addressed the doubts raised by the Federal Court of Justice (BGH) as to whether the failure to fulfill information obligations could constitute an infringement of rights "as a result of processing" within the meaning of Article 80(2) GDPR. The ECJ based its reasoning in particular on recitals 10, 13, 39, 58, 60, and 142 of the GDPR, according to which

· equivalent protection in all EU Member States, including equivalent possibilities for legal enforcement, is to be aimed for;

·       every processing of personal data must be lawful and in good faith, i.e., above all, transparent.

To this end, the GDPR sets out principles for the processing of personal data and the rights of data subjects, which must be observed during any processing of personal data. This includes the information rights of data subjects under Article 12 et seq. GDPR, from which the controller's information obligation follows. Accordingly, the failure to fulfill the information obligation can be asserted under Article 80(2) GDPR. Regarding the specific case, the ECJ further explained that without all information being provided, no informed and therefore effective consent can be given.

The Federal Court of Justice (BGH) has now incorporated this into German law and ruled that associations may pursue data protection violations under the Act Against Unfair Competition (UWG) and the Injunctions Act (UKlaG) on the basis of Article 80(2) of the GDPR. Specifically, the Federation of German Consumer Organizations is authorized under Section 8(3) no. 3 of the UWG and Section 3(1) sentence 1 no. 1 of the UKlaG to take legal action against breaches of information obligations pursuant to Article 12(1) sentence 1 of the GDPR in conjunction with Article 13(1) letters c and e of the GDPR, due to violations of the Act Against Unfair Competition and a consumer protection law within the meaning of Section 2(1) and (2) sentence 1 no. 13 of the UKlaG.

For a better overview, we have summarized the course of the proceedings for you here:

Default judgment of the Berlin Regional Court dated September 9, 2013 – 16 O 60/13

Berlin Regional Court, judgment dated October 28, 2014 – 16 O 60/13

Berlin Court of Appeal, judgment dated September 22, 2017 – 5 U 155/14

Federal Court of Justice, order dated April 11, 2019 – I ZR 186/17 (stay of proceedings pending the ECJ referral order in case C-40/17)

Federal Court of Justice, stay of proceedings and referral order dated May 28, 2020 – I ZR 186/17

Advocate General at the ECJ, opinion dated December 2, 2021 – C-319/20

ECJ, judgment dated April 28, 2022 – C-319/20

Federal Court of Justice, stay of proceedings and referral order dated November 10, 2022 – I ZR 186/17

Advocate General at the ECJ, opinion dated January 25, 2024 – C-757/22

ECJ, judgment dated July 11, 2024 – C-757/22 

Federal Court of Justice, judgment dated March 27, 2025 – I ZR 186/17

Our follow-up article on the standing of competitors to sue for data protection violations will follow…

‍

Anja Hillig, Salary Partner

‍