New Class Action mechanism for Data Protection in France

By Ariane Mole, Juliette Terrioux


A new French Act on “the modernisation of 21st century justice” was published on November 19, 2016 which creates a general framework for class action in France.

Unlike the 2014 French Law on Consumer protection, which introduced the class action mechanism but restrained its scope to the compensation of material damages, this new Act allows for class actions in the following matters: discriminations, health, environment and data protection. As such the Act contains specific provisions allowing for collective action against data protection breaches. The scope is wide, since it applies to any violation of French data protection legislation.

France is not the only European country where class action in data protection matters has been introduced. In Belgium, a collective action mechanism (including the redress of breaches of the provisions of the Belgian Federal Privacy Law) has been in place since September 2014 and in Germany since February 24, 2016 consumer associations, industry and commerce chambers or other approved business associations are able to sue in case of data protection violations. In Germany new enforcement powers were offered to such associations and chambers and inspections were therefore encouraged. This new mechanism is very likely to result in an increase of sanctions for violations of German data protection laws (please see the specific news alert of our German office on this topic). 

Chapter VI of Title V of the French Act on “the modernisation of 21st century justice” sets out the rules applicable to class actions against data protection violations before civil and administrative courts.

Who can launch a collective action?

The Act gives an exhaustive and limited list of organisations which will be able to take actions on behalf of individuals, provided that such individuals are put in a similar position and suffer damage as a consequence of a data protection breach of the same nature whether the breach was done by a data controller or a data processor.

In order to be allowed to introduce a class action, the organisation must be a duly-registered association in existence for at least five years with a purpose to protect privacy and personal data. This condition is of course restrictive and will prevent organisations being created for the sole purpose of launching a class action, since the organisation will need to (i) be created with a purpose to protect personal data and (ii) will need to have at least 5 years of existence as such. Apart from this, class actions can be done by consumer associations at national level and agreed in accordance with article L.811-1 of the French Consumer Code when the personal data processing affects consumers, or by trade union organisations which represent employees or civil servants when the processing affects the interests of the persons whose interests the trade union is representing.

What is the purpose of the action?

This point is already heavily criticised because the Act provides that class actions against data protection breaches will have for sole purpose to put an end to the data protection alleged violations. Therefore, and contrarily to the other types of class action, the data protection collective action will not enable compensation for the damage suffered. The Act restrains its scope to the only cease of the alleged breach. Therefore plaintiffs in data protection class actions will not be able to receive financial compensation for the damage suffered in this new context.

However, each person concerned may then decide to launch another action individually before civil or administrative courts to claim for compensation which will be facilitated by the result of the class action.

What are the impacts on businesses?

The recognition of the concept of class action for data protection breaches will increase the risk for companies to be scrutinised on their data protection activities and then sued before courts, especially by consumer associations and trade unions. Even though companies do not need to be concerned about compensation in the context of data protection class actions since the scope of such action is restrained, this type of action will notably entail a significant increase in reputational risk for companies.

Consumer associations and trade unions are already very active in France on data protection matters and it is likely that they will use the new possibilities offered by the act.