The texts published are drafted in their original language and are not subject to any translation.
Personal data
class action
The “personal data” class action was introduced by the Law on the Modernisation of Justice in the 21st Century. It is provided for in Article 37 of Law No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties (see Ordinance No. 2018-1125 of 12 December 2018, Article 1, entered into force on 1 June 2019).
Originally, it could only seek the cessation of infringements. Subsequently, Law No. 2018-493 of 20 June 2018 on the protection of personal data extended its scope to allow claims for compensation. Where the action seeks compensation for harm suffered, it may only be brought if the event giving rise to the damage occurred after the entry into force of the GDPR on 24 May 2018.
The “personal data” class action aims at the cessation of infringements, through injunctions to act or to refrain from acting, of the provisions of Regulation (EU) 2016/679 of 27 April 2016 or of the French Data Protection Act, and/or the compensation of material and non-material damage suffered by natural persons placed in a similar situation.
Thus, for example, the class action may seek the cessation of breaches of the rights to information, objection, access, rectification and communication of personal data contained in automated files, or of the ability to exercise these rights electronically, as well as compensation for the harm resulting therefrom. The same applies to access to information concerning the purposes of processing, the categories of personal data processed, and the recipients or categories of recipients to whom the data are disclosed.
The group may consist of identified or identifiable natural persons – or their heirs.
Standing to bring the action is granted to three types of organisations :
-
associations registered for at least five years whose statutory purpose includes the protection of privacy or the protection of personal data;
-
nationally representative and accredited consumer associations, where the processing of personal data affects consumers;
-
representative trade unions of employees or civil servants within the meaning of the Labour Code.
The class action is directed against the “data controller” and/or the “processor” within the meaning of the GDPR.
Compensation is granted through the individual redress procedure.
To date, two class actions appear to have been brought:
-
Internet Society France against Facebook for non-compliance with the General Data Protection Regulation (GDPR);
-
UFC-Que Choisir against Google on the grounds that user consent for the collection and processing of personal data, in particular for targeted advertising purposes, was not obtained in compliance with the GDPR.
Other collective actions
A collective action is provided for in Article 38 of Law No. 2018-493 of 20 June 2018 adapting the Data Protection Act of 6 January 1978 to the new European legal framework, pursuant to Ordinance No. 2018-1125 of 12 December 2018 adopted under Article 32 of Law No. 2018-493 of 20 June 2018 on the protection of personal data and amending Law No. 78-17 of 6 January 1978 on Information Technology, Data Files and Civil Liberties and various provisions relating to the protection of personal data).
It is a joint representative action, pursuant to Article 80.1 of the GDPR, and is based on less stringent conditions than the class action. Indeed, under the wording resulting from the aforementioned Law of 20 June 2018, the associations that could be mandated were those meeting the same conditions as for the class action, namely having five years’ existence. The Ordinance of 12 December 2018 removed this condition. Consequently, in order to bring a class action, therefore without a mandate ab initio, the association must have five years’ existence, whereas to bring a collective action based on mandates or before the CNIL, this condition is no longer required before the courts. Five “collective” actions were brought by La Quadrature du Net until December 2019 and made public, including one following the €50 million fine imposed by the CNIL on Google. The June 2020 report, cited above, p. 21, mentions seven actions.