Group action in case of personal data breach
Verified 07 April 2021 - Legal and Administrative Information Directorate (Prime Minister)
If your personal data, you can participate in a group action called class action. Use this procedure to stop the violation of your data. It also allows you to obtain compensation for the damage suffered if the event occurred after May 24, 2018. You must contact an approved association or certain unions. The association or union implements the group action for people who are in the same situation as you.
A group action may be launched if several persons consider that they have suffered damage as a result of the same failure of a trader to fulfil his obligations in respect of personal data.
For example, if a company's website does not comply with the rules for protecting users' personal data.
The group action allows the persons concerned to defend themselves collectively before the court.
We also talk about class action
FYI
an official processing of personal data must respect European Data Protection Regulation (GDPR) .
You can use group action if 2 are completed:
- You believe that you have suffered damage as a result of the failure of a processing its obligations to protect personal data. For example, you have been robbed of your personal information.
- At least 2 persons consider that they have suffered prejudice in respect of personal data resulting from the same failure of a trader
Be sure to keep any documents that prove your injury.
Only one of the following bodies may bring a class action suit:
- Privacy and personal data protection association declared for at least 5 years
- National Consumer Association
- Representative trade union
The association or the union initiates the group action on behalf of all the persons concerned.
The association or the union claims on behalf of all the persons concerned damages to the failed controller.
You do not need to be a member of the association or the union to obtain compensation for the damage suffered.
FYI
the association or union that initiates the class action shall bear the legal costs. You have no fees to pay.
The effects are different if the infringement of your personal data takes place before or after May 25, 2018.
Since 25 May 2018
The judge can order to stop the violation of your personal data.
The judge may also order compensation for persons connected with the class action.
Each person participating in the group action shall be compensated individually.
Compensation may involve material or moral harm.
A material injury affects a property or a financial interest.
For example, you incur a financial loss as a result of a theft caused by the disclosure of your personal data.
Moral harm affects emotional well-being, honour or reputation.
For example, your reputation is damaged by the publication of personal documents.
Before 25 May 2018
The judge can order to stop the violation of your personal data.
- Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal dataRepresentation of persons in case of appeal (Article 80)
- Act No. 78-17 of January 6, 1978 on Information Technology, Files and Freedoms: Article 37
- Act No. 2016-1547 of 18 November 2016 for the modernisation of justice in the twenty-first centuryGroup action (Articles 62 to 84)
- Code of Administrative Justice: Articles L77-10-1 to L77-10-2Group Action
- Code of Administrative Justice: Section R77-10-1 to R77-10-22Group Action
- Computer files and personal dataService-Public.fr
- Approved consumer associationsService-Public.fr
- Videosurveillance of public roads and public placesService-Public.fr
- What is group action?Ministry of Economy
- GDPR: what are we talking about?National Commission on Informatics and Freedoms (Cnil)
- How and when to enter the Cnil?National Commission on Informatics and Freedoms (Cnil)