GER: BGH on Consumer Protection and GDPR Breaches

Apr 11, 2025 Benn-Ibler Rechtsanwälte

A breach of data protection obligations to inform users of social networks about the scope and purpose of collection as well as use of their personal data by the operator of that network justifies claims for injunctive relief under competition law and can be pursued by consumer protection organisations by way of legal action.

In the case at hand, the defendant, a company based in Ireland, operates a social network. In 2012, online games were offered by the defendant in the platform’s so-called ‘app centre’, where users were required to disclose their data without being fully informed about the nature, scope, and purpose of their data being processed. Only insufficient information on data processing was provided below the 'Play Now' button, which, according to the plaintiff association, the Federation of German Consumer Organisations, constituted a breach of the General Data Protection Regulation (GDPR). The association argued that the defendant had failed to fulfil its obligations to provide information on data protection, resulting in an unreasonable disadvantage for users and thus also in anti-competitive behaviour. The claimant therefore demanded that the defendant cease these practices.

At first instance, the court of appeal granted the application. On appeal, the defendant pursued its application for dismissal. The German Federal Court of Justice (Bundesgerichtshof, hereinafter BGH) then stayed the proceedings and referred specific questions to the European Court of Justice for a preliminary ruling on the interpretation of the General Data Protection Regulation. The ECJ ruled in favour of the plaintiffs, confirming the view that breaches of data protection rules may also be relevant under competition law.

In its decision, the BGH has now clarified that consumer associations are entitled under Article 80(2) of the GDPR to sue for breaches of data protection information obligations. It is not necessary for the plaintiff to specifically name the data subjects. It is sufficient that the action relate to a group of data subjects whose rights are potentially affected by any such breaches.

Press release no. 59/2025 on BGH I ZR 186/17 (27 March 2025)