The law n°2016-1547 dated 18 November 2016 for the modernization of the justice of the XXIst century has extended the right to class action in many areas and notably regarding personal data processing.
Based on new Article 43 ter of the French data protection law (law n°78-17 dated 6 January 1978 on data processing, files and liberties), individuals now have the right to bring a class action before the civil or administrative courts when they are in the same situation and suffer damages caused by a similar breach of the data protection law committed by a data controller or a data processor.
However, the use of this new right is strictly limited as it can only be exercised by:
associations duly registered for at least five years whose statutory purpose is the protection of privacy and personal data;
representative and certified consumers protection associations when the data processing affects consumers;
unions representing employees or civil servants when the data processing affects the interests of employees or civil servants.
Doubts about the efficiency of actions brought on the basis of this new provision have already been expressed because unlike class actions regarding environmental or discrimination matters, class actions regarding personal data shall exclusively aim at ending the breach and not at indemnifying the damage suffered by the concerned individual.
However, the existence of such right constitutes a new legal risk for the data controllers and their sub-contractors and service providers who were until now rarely sued on civil grounds. The reinforcement of the individual’s rights resulting from this new provision should lead companies and administrations to increase their vigilance in the implementation of their personal data processing.
Key words: Behring – Anne-Solène Gay – Law n°2016-1547 of 18 November 2016 for the modernization of the justice of the XXIst century – Law n°2016-1547 of 18 November 2016 – Article 91 – Law n°78-17 dated 6 January 1978 on data processing, files and liberties – Law n°78-17 dated 6 January 1978 – Article 43 ter – class action – class actions regarding personal data – personal data – data protection – data protection law
