Actions for non-material damages following (alleged) infringements of the General Data Protection Regulation (GDPR) are increasingly being brought before courts across Europe. But legal requirements for the recognition of non-material damages are still to a large extent unclear.
In our new blog post series, we explain the situation in several countries across Europe (see our introduction). Please find out below about GDPR damages claims in France.
In France, personal data related collective actions are enshrined in the French Data Protection Act no. 78-17 of 6 January 1978 (FDPA). While France does not have a long history of implementing such actions, a significant number of collective actions have been introduced (especially against major tech companies) and made public over the past few years. Two types of collective action coexist in the FDPA:
- collective actions with representation of data subjects (also known as ‘joint representation actions’) which consist for entitled associations, based on individual mandates of multiple data subjects, to jointly exercise their rights to lodge a complaint with the French supervisory authority (CNIL), to appeal the CNIL’s decisions or to seek damages against a data controller or processor in front of a court; and
- collective actions without representation of data subjects (also known as ‘class actions’), which consist for entitled associations to bring an action against a data controller/ processor in order to stop a GDPR/FDPA breach and/or requesting damages resulting from a GDPR/FDPA breach before a court independently of any mandate from actual data subjects, but on the basis of the existence of a class of data subjects suffering similar harm.
With respect to joint representation actions, the association ‘La Quadrature du Net’ (LQDN) has been one of the most active organisms in France so far. It has notably filed five complaints with the CNIL on 28 May 2018 against major US tech companies, based on a mandate of 12,000 people. Similarly, the organisations Privacy International and None of Your Business (NOYB) have been very active in introducing such actions in France, which sometimes resulted in high sanctions from the CNIL.
With respect to personal data-related class actions based on the FDPA, according to publicly available information, two class actions have been initiated in France so far, in 2019, which are still pending, respectively by the consumer association UFC Que Choisir and by the American association Internet Society against US tech companies.
In addition to the collective actions provided for in the FDPA, the French consumer code also enables consumer defense associations to bring actions to courts in ‘the collective interest of consumers’ without any specific mandate. The UFC Que Choisir is particularly active in this field. These actions enable to obtain the cessation of conducts (including by declaring contractual provisions null and void) which are in breach of consumer law and/or the FDPA, as well as damages which are paid to the association based on damages to the “collective interest” of consumers.
France has not transposed the EU-RAD yet, but the draft law is under legislative process at the French Parliament. This law aims at standardising various collective actions regimes provided by French law in various areas (eg environment, public health, data protection), including the collective action without representation mentioned above (while the collective action with representation of data subjects, which results from Article 80 para. 1 of the GDPR, would not be concerned by this law).
The next blog post in our data and tech mass claims series will focus on The Netherlands.
