French initiatives: "class action" or "collective action" for personal data protection?

Both the French Council of State in its annual report for 2014 as well as the National Digital Council (hereinafter, "CNNum") in its "Digital Ambition" report voiced support for the creation of an action enabling consumers to collectively seek redress for violations of regulations protecting personal data.

However, their recommendations are different regarding the goal of this action.

After some hesitation and numerous debates, the collective action for data protection finally became a reality in November 2016 thanks to the adoption of the law on the modernisation of 21st century justice.

Creation of a general framework applicable to class actions in France

In the scope of the adoption of the Law on 21st century justice, the French lawmaker intended to create a common general set of rules which would be applicable to various specific class actions.

The ambition was, therefore, to create what could be described as a "class action common law", composed of a corpus of general rules which would be applicable to specific class actions, unless otherwise provided.

Article 60 of the Law on 21st century justice lists five specific class actions to which the common set of rules relates and is applicable and relating to:

• the fight against discrimination;
• discrimination in the workplace;
• environmental claims;
• health issues; and
• computer technology, data and freedoms (see below).

Regarding the persons having the capacity to bring such a class action, only registered associations and associations which have been duly declared for at least five years, the statutory purpose of which includes defending interests that have been harmed will be able to initiate a claim¹.

As to the goal of the class action, the Law on 21st century justice specifies that the newly created action aims to either put an end to violations, compensate the damages, or both².

Creation of a collective action for personal data protection

A new Article 43 ter was created in Law no. 78-17 of 6 January 1978 relating to computer technology, data and freedoms (the "French Data Protection Law").

This Article provides a "class action" for "individuals" (hence excluding legal persons) who sustain a loss resulting from a breach of similar nature of the French Data Protection Law by a data controller or data processor.

Article 43 ter of the French Data Protection Law expressly specifies that the action may only aim at putting an end to the infringement.

Therefore, it cannot give rise to compensation of the damage suffered by the individuals.

During the debates, the Rapporteur of the Law Commission of the Senate underlined the paradox consisting in requiring a proof of damage to bring this class action whereas this damage to bring this class action whereas this action does not enable the compensation of such damage".

Lastly, Article 43 ter of the French Data Protection Law provides a list of the people entitled to pursue this action: mainly, authorised consumers or privacy protection associations and employees or civil servants' trade unions.

Footnotes

1. Law on 21st century justice, Article 63
2. Law on 21st century justice, Article 62, §2

This article forms part of our Data class actions: the era of mass data litigation guide.

Next steps

Take advantage of the far-reaching changes brought about by the GDPR with our European Privacy Tool, which offers realistic, practical and workable insights as well as templates, helping to ensure that you are successful in meeting the applicable regulatory requirements.