Judgment;Abstract — ECLI:EU:C:2022:322
Date: 2022-04-28
Language of the case: German
Court formation: Third Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Germany

Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
15 July 2020 
Referring court: 
Bundesgerichtshof (Federal Court of Justice, Germany) 
Date of the decision to refer: 
28 May 2020 
Defendant and appellant in the appeal on a point of law: 
Facebook Ireland Limited 
Applicant and respondent in the appeal on a point of law: 
Bundesverband der Verbraucherzentralen und 
Verbraucherverbände – Verbraucherzentrale Bundesverband e.V. 
  
Subject matter of the main proceedings 
Application for a prohibitory injunction owing to a breach of provisions of data 
protection law 
Subject matter and legal basis of the reference 
Interpretation of Chapter VIII, in particular Article 80(1) and (2) and Article 84(1) 
of the General Data Protection Regulation; Article 267 TFEU 
Question referred 
Do the rules in Chapter VIII, in particular in Article 80(1) and (2) and 
Article 84(1), of Regulation (EU) 2016/679 preclude national rules which – 
alongside the powers of intervention of the supervisory authorities responsible for 
monitoring and enforcing the Regulation and the options for legal redress for data 
subjects – empower, on the one hand, competitors and, on the other, associations, 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-319/20 
 
2  
entities and chambers entitled under national law, to bring proceedings for 
breaches of Regulation (EU) 2016/679, independently of the infringement of 
specific rights of individual data subjects and without being mandated to do so by 
a data subject, against the infringer before the civil courts on the basis of the 
prohibition of unfair commercial practices or breach of a consumer protection law 
or the prohibition of the use of invalid general terms and conditions? 
Provisions of EU law cited 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation), Chapter VIII, in particular 
Article 80(1) and (2) and Article 84(1) [(‘the Regulation’)] 
Provisions of national law cited 
Gesetz über Unterlassungsklagen bei Verbraucherrechts- und anderen Verstößen 
(Law on prohibitory injunctions in the case of breaches of consumer and other 
laws, ‘the UKlaG’), Paragraph 1 (Prohibitory injunctions and rights of 
cancellation in general terms and conditions), Paragraph 2 (Rights in the case of 
practices contrary to consumer protection law) subparagraph 2(11), Paragraph 3 
(Authorities entitled) and Paragraph 4 (Qualified entities) 
Gesetz gegen den unlauteren Wettbewerb (Law against unfair competition, ‘the 
UWG’), Paragraph 3 (Prohibition of unfair commercial practices), Paragraph 3a 
(Breach of law) and Paragraph 8 (Removal and injunctive relief) subparagraphs 1 
and 3 
Telemediengesetz (Law on telemedia, ‘the TMG’), Paragraph 13 (Duties of the 
service provider) 
Brief summary of the facts and procedure 
1 The applicant is the Federation of German consumer organisations, which is 
included on the list of qualified entities pursuant to Paragraph 4 of the UKlaG. 
Using the address www.facebook.de, the defendant, a company established in 
Ireland, operates the internet platform Facebook which is used to exchange 
personal and other data. A sister company of the defendant, Facebook Germany 
GmbH, established in Germany, advertises the availability of advertising space on 
the internet platform and supports the defendant’s local advertising clients there. 
The defendant is the contract partner for advertising clients in Germany. It also 
processes the data of Facebook’s German customers. The parent company of the 
defendant and of Facebook Germany GmbH is established in the United States. 
FACEBOOK IRELAND 
 
3 
2 The Facebook internet platform has what is referred to as an App Centre where 
the defendant makes available to its users, amongst other things, free games from 
third party suppliers. When the App Centre was accessed on 26 November 2012, 
the game ‘The Ville’ was being offered there and the following information was 
displayed under a ‘Play now’ button: 
3 If you click on ‘Play game’ above, this application obtains the following: – Your 
general information (?), – Your email address, – About you, – Your status 
messages. This application may post on your behalf, including your score and 
more. 
4 The following notice was also provided there: By continuing, you accept The 
Ville’s general terms and conditions and data protection policies. 
5 The general terms and conditions and data protection rules could be accessed via a 
link. Corresponding notices were also displayed in various other games. In the 
game ‘Scrabble’, the notices ended with the sentence: This application may post 
status messages, photos and more on your behalf. 
6 The applicant objects to the presentation of the notices provided under the ‘Play 
now’ button in the App Centre as being unfair, amongst other things, from the 
aspect of a breach of law on account of infringement of the legal requirements for 
obtaining the user’s valid consent under data protection law. It also regards the 
final notice in the game ‘Scrabble’ as a general condition which is unreasonably 
prejudicial to the user. 
7 The applicant is essentially requesting that the defendant be ordered to cease and 
desist from the described practices vis-à-vis consumers who are permanently 
resident in the Federal Republic of Germany, and be prohibited from using a 
clause like the one used in connection with the game ‘Scrabble’. 
8 The applicant lodged the action independently of the specific infringement of data 
protection rights of a data subject and without being mandated to do so by such a 
person. 
9 The Landgericht (Regional Court, Germany) ruled against the defendant, in 
accordance with the application. The defendant’s appeal was unsuccessful. The 
defendant is continuing to seek the dismissal of the action by means of its appeal 
on a point of law, the dismissal of which is being requested by the applicant. 
Brief summary of the basis for the reference 
10 In the opinion of the referring court, the appeal court rightly considered the claims 
in the application to be well founded. For the appeal on a point of law to be 
successful, it is therefore relevant whether the appeal court was correct in law in 
proceeding on the basis that the action was admissible. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-319/20 
 
4  
11 In examining the admissibility of the action, a question arises as to the 
interpretation of Regulation 2016/679. It is questionable whether, following the 
entry into force of Regulation 2016/679, qualified entities, such as the consumer 
association that brought the action in this case, are empowered, under 
Paragraph 8(3)(3) of the UWG and Paragraph 3(1)(1) of the UKlaG, to bring 
proceedings before the civil courts for breaches of the Regulation independently 
of any specific infringement of rights of individual data subjects and without 
being mandated to do so by a data subject, on the basis of a breach of law 
according to Paragraph 3a of the UWG, breach of a consumer protection law 
within the meaning of Paragraph 2(2)(11) of the UKlaG or the use of invalid 
general terms and conditions according to Paragraph 1 of the UKlaG. 
12 The claims based on the infringement of Paragraph 13(1) of the TMG were 
admissible and well founded before Regulation 2016/679 came into force. 
13 According to the first half of the first sentence of Paragraph 13(1) of the TMG, at 
the beginning of the act of use, the service provider must inform the user about the 
nature, scope and purpose of the collection and use of personal data in a generally 
understandable form, to the extent that such information has not already been 
provided. The appeal court was correct in law in assuming that the information in 
the App Centre being challenged in the application did not meet these 
requirements and that the action was therefore well founded in this respect. 
14 By breaching the duties of information specified in the first half of the first 
sentence of Paragraph 13(1) of the TMG, the defendant breached Paragraph 3a of 
the UWG and Paragraph 2(2)(11) of the UKlaG. The appeal court rightly 
proceeded on the basis that the provisions under Paragraph 13 of the TMG at issue 
here are market conduct regulations within the meaning of Paragraph 3a of the 
UWG. They are also requirements which, as provided for in Paragraph 2(2)(11) of 
the UKlaG, regulate the lawfulness of the collection, processing or use, by an 
economic operator, of personal data of a consumer which have been collected, 
processed or used for advertising purposes. The appeal court also rightly 
proceeded on the basis that the fact that the defendant was established in Ireland 
did not preclude the applicability of German data protection law. The Court of 
Justice of the European Union, in its judgment of 5 June 2018, 
Wirtschaftsakademie Schleswig-Holstein (C-210/16, EU:2018:388, paragraph 55), 
has already decided, with respect to the relationship – which also exists in the 
present case – between the defendant, established in Ireland and responsible for 
processing the data relevant in the present case, and its sister company, established 
in Germany and responsible merely for promoting the sale of advertising in 
Germany, that the German sister company is to be regarded as an establishment 
within the meaning of Article 4(1)(a) of Directive 95/46/EC. 
15 The defendant also used a general condition which was invalid according to 
Paragraph 1 of the UKlaG owing to a breach of the duties of information under 
data protection law that are relevant in the present case. The action was originally 
well founded in this respect also. 
FACEBOOK IRELAND 
 
5 
The issue of the admissibility of the action 
16 The action was originally also admissible. In particular, the applicant had the 
power to pursue its claims by way of an action before the civil courts before 
Regulation 2016/679 came into force. 
17 According to Paragraph 8(3)(3) of the UWG, qualified entities which can prove 
that they are included on the list of qualified entities pursuant to Paragraph 4 of 
the UKlaG have a right under Paragraph 8(1) of the UWG to a prohibitory 
injunction in respect of commercial practices which are unlawful according to 
Paragraph 3 of the UWG. The applicant consumer association is included on the 
list of qualified entities pursuant to Paragraph 4 of the UKlaG. As such an entity, 
the applicant had the power under Directive 95/46/EC to pursue, by way of a 
prohibitory injunction under Paragraph 8(1) and (3)(3) of the UWG in conjunction 
with Paragraph 3(1) and Paragraph 3a of the UWG, infringements of data 
protection law (here: Article 10(a) of Directive 95/46/EC and the first half of the 
first sentence of Paragraph 13(1) of the TMG) on the basis of a breach of law as 
an unlawful commercial practice (see judgment of the Court of Justice of 29 July 
2019, Fashion ID, C-40/17, EU:C:2019:629, paragraph 63). 
18 The applicant’s power to apply for a prohibitory injunction was also set out in 
Paragraph 3(1)(1) of the UKlaG, according to which qualified entities within the 
meaning of that provision may seek an injunction on account of breaches of 
consumer protection laws, including, according to Paragraph 2(2)(11) of the 
UKlaG, provisions which relate to the lawfulness of the collection, processing or 
use of personal data of a consumer by an economic operator for advertising 
purposes. 
19 The power to bring a claim in relation to the use of a general condition followed 
from Paragraph 3(1)(1) of the UKlaG. According to the latter, qualified entities 
have a right, under Paragraph 1 of the UKlaG, to an injunction against the use of 
general terms and conditions that are invalid according to Paragraph 307 of the 
Bürgerliches Gesetzbuch (German Civil Code, ‘the BGB’). Before Regulation 
2016/679 came into force, qualified entities within the meaning of 
Paragraph 3(1)(1) of the UKlaG could therefore, according to Paragraph 1 of the 
UKlaG, take action by way of a prohibitory injunction against the user of a 
general condition that was invalid according to Paragraph 307 of the BGB owing 
to the infringement of a provision of data protection law. 
20 This legal position may have changed in a way that is relevant to the decision in 
this case when Regulation 2016/679 came into force. 
21 The claims are well founded even after the entry into force of Regulation 
2016/679. It is true that the provision laid down in Paragraph 13(1) of the TMG 
has since ceased to be applicable. What are relevant now are the duties of 
information arising from Articles 12 to 14 of Regulation 2016/679. The defendant 
breached its obligation under the first sentence of Article 12(1) of Regulation 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-319/20 
 
6  
2016/679 to provide the data subject with the information resulting from 
Article 13(1)(c) and (e) of the Regulation relating to the purpose of the data 
processing and the recipient of personal data in a concise, transparent, intelligible 
and easily accessible form, using clear and plain language. 
22 However, the applicant’s initial standing to bring proceedings will have lapsed 
when Regulation 2016/679 came into force if the question referred for a 
preliminary ruling is to be answered in the affirmative. The lapsing of standing to 
bring proceedings would also have to be taken into account in the appeal on a 
point of law and means that the action would be inadmissible. 
The standing of associations to bring proceedings under competition law? 
23 It is a matter of dispute whether qualified entities within the meaning of 
Paragraph 4 of the UKlaG have the power, following the entry into force of 
Regulation 2016/679, to plead breaches of data protection provisions of the 
Regulation, which are directly applicable according to the first sentence of the 
second paragraph of Article 288 TFEU, under Paragraph 8(3)(3) of the UWG 
from the aspect of a breach of law according to Paragraph 3a of the UWG. 
24 One view assumes that conclusive provision on the enforcement of the data 
protection provisions contained in Regulation 2016/679 is made in the Regulation 
itself; it therefore denies competitors any standing to bring proceedings under 
competition law and assumes that associations have standing to bring proceedings 
only under the conditions set out in Article 80 of the Regulation. 
25 Others consider the rules set out in Regulation 2016/679 on the enforcement of 
rights not to be conclusive and therefore regard the competitors, associations and 
entities mentioned in Paragraph 8(3) of the UWG as still having the power to seek 
prohibitory injunctions in proceedings on the basis of a breach of law within the 
meaning of Paragraph 3a of the UWG. 
26 Yet others deny that competitors have any standing to bring proceedings but allow 
that associations do have standing as provided in Paragraph 3 of the UKlaG in 
order to pursue breaches according to Paragraph 2(2)(11) of the UKlaG, in so far 
as the associations meet the conditions specified in Article 80(2) of Regulation 
2016/679. 
27 It is, finally, also argued that Regulation 2016/679 has made no difference to the 
standing of competitors to bring proceedings in accordance with Paragraph 8(3)(1) 
of the UWG, whilst associations have standing to bring proceedings only under 
the conditions set out in Article 80 of the Regulation.  
28 No standing of qualified entities which are acting within the meaning of 
Paragraph 8(3)(3) of the UWG to bring proceedings in order to protect consumer 
interests can be inferred from the wording of Regulation 2016/679, specifically 
the provisions of Chapter VIII thereof. 
FACEBOOK IRELAND 
 
7 
29 It is true that provision is made in Article 80(1) of Regulation 2016/679 for not-
for-profit bodies, organisations or associations which have been properly 
constituted in accordance with the law of a Member State, have statutory 
objectives which are in the public interest, and are active in the field of the 
protection of data subjects’ rights and freedoms with regard to the protection of 
their personal data, to have standing to bring proceedings. However, this is 
conditional upon the body, organisation or association having been mandated by 
the data subject to exercise the rights referred to in Articles 77, 78 and 79 of the 
Regulation on the data subject’s behalf, and to exercise the right to receive 
compensation referred to in Article 82 of the Regulation on the data subject’s 
behalf where provided for by Member State law. 
30 The standing to bring proceedings pursuant to Paragraph 8(3)(3) of the UWG at 
issue here does not relate to an action brought on behalf and in the name of a data 
subject to enforce their personal rights. Rather, that provision regulates the 
standing of associations to bring proceedings in their own right, a right which 
allows them, in connection with an act in breach of the law according to 
Paragraph 3a of the UWG, to take objective legal action against breaches of the 
provisions of Regulation 2016/679 independently of any infringement of specific 
rights of individual data subjects and of a mandate to do so. 
31 Nor is any standing for associations to bring proceedings for the objective legal 
enforcement of data protection law regulated in Article 80(2) of Regulation 
2016/679. According to that provision, it is true, Member States may provide that 
any body, organisation or association referred to in paragraph 1 of that article, 
independently of a data subject’s mandate, has the right to lodge, in that Member 
State, a complaint with the supervisory authority which is competent pursuant to 
Article 77 of the Regulation and to exercise the rights referred to in Articles 78 
and 79 of the Regulation. However, it is also necessary for the rights of a data 
subject under the Regulation to have been infringed as a result of the processing. 
Therefore, according to the wording thereof, the provision under Article 80(2) of 
Regulation 2016/679 likewise confers no standing to bring proceedings on 
associations which – as in the present case based on Paragraphs 3a and 8(3)(3) of 
the UWG – plead objective breaches of data protection law independently of the 
infringement of subjective rights of a specific data subject. This is also apparent 
from the second sentence of recital 142 of Regulation 2016/679 which likewise 
mentions the requirement of infringement of the rights of a data subject as a 
condition for associations’ standing to bring proceedings independently of any 
mandate by the data subject. 
32 Nor can the lawfulness of the standing of associations to bring proceedings be 
based on Article 84(1) of Regulation 2016/679, according to which Member 
States are to lay down the rules on other penalties applicable to infringements of 
the Regulation and take all measures necessary to ensure that they are 
implemented. The standing of associations to bring proceedings, as regulated in 
Paragraph 8(3) of the UWG, cannot be a penalty according to the scheme of 
Regulation 2016/679 simply because, in Chapter VIII of the Regulation, the EU 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-319/20 
 
8  
legislature expressly distinguishes between legal remedies, liability and penalties 
and it is apparent from the connection between Article 84, Article 83 and 
recitals 148 to 152 of the Regulation that the penalties within the meaning of 
Article 84 of the Regulation are administrative and criminal penalties for 
infringements. 
33 An interpretation that takes into account the systematic context of Regulation 
(EU) 2016/679 does not clearly show whether, by this Regulation, the EU 
legislature unified not only the provisions on the protection of personal data, but 
also enforcement of the rights that exist under the Regulation. 
34 Regulation 2016/679 confers on supervisory authorities within the meaning of 
Article 51(1) and Article 4(21) of the Regulation extensive monitoring duties and 
investigative and remedial powers. It might be inferred therefrom that the EU 
legislature basically assumes enforcement of the provisions of the Regulation by 
the supervisory authorities. The saving clause relating to the regulation of the 
standing of associations to bring proceedings pursuant to Article 80(2) of 
Regulation 2016/679 could represent an exception with respect to these 
comprehensive rules on the duties and powers of supervisory authorities. In light 
of the above, a broad interpretation of the saving clause of Article 80(2) of 
Regulation 2016/679 addresses concerns while disregarding the condition of the 
‘rights of a data subject’ laid down in that provision. 
35 Accordingly, the Advocate General (Opinion of Advocate General Bobek of 
18 December 2018 in Fashion ID, C-40/17, EU:C:2018:1039, point 47) also 
assumes that, owing to the enactment of Regulation 2016/679 to replace Directive 
95/46/EC which left the Member States free to choose how to implement it, 
national rules implementing the Regulation may, in principle, only be adopted 
when expressly authorised. 
36 However, the fact that Article 77(1), Article 78(1) and (2) and Article 79(1) of 
Regulation 2016/679 each contain the phrase ‘without prejudice to any other 
remedy’ might suggest that the provision is not conclusive. In addition, 
Article 82(1) of Regulation 2016/679 accords any person who has suffered 
material or non-material damage as a result of an infringement of the Regulation 
the right to receive compensation. It could be inferred from this that Regulation 
2016/679 does not rule out action being taken against the infringement of data 
protection provisions of the Regulation by a party other than the data subject 
within the meaning of Article 80(2) of the Regulation. 
37 Nor does the legislative objective provide a clear answer to the question referred. 
38 The assumption that an association’s standing to bring competition-law 
proceedings under Paragraph 8(3)(3) of the UWG continues to be lawful may be 
supported by the fact that this preserves an additional option for the enforcement 
of rights, one that is desirable in accordance with the principle of effectiveness, 
FACEBOOK IRELAND 
 
9 
thereby ensuring the highest possible level of data protection in accordance with 
recital 10 of Regulation 2016/679. 
39 On the other hand, the lawfulness of such standing of associations to bring 
proceedings might be incompatible with the aim of unification pursued by the EU 
legislature when drafting Regulation 2016/679. Enforcement of data protection 
provisions by private individuals – that is to say, on the one hand, by competitors 
and, on the other, by business and consumer associations within the meaning of 
Paragraph 8(3) of the UWG – going beyond the instruments set out in the 
Regulation might be inconsistent with this aim. 
40 Nor is it entirely certain that there is a gap in protection in the system for 
enforcing the Regulation which would have to be filled by giving private 
individuals standing to bring competition-law proceedings under Paragraph 8(3) 
of the UWG. According to Article 8(3) of the Charter of Fundamental Rights of 
the European Union, compliance with the protection of a person’s personal data is 
to be subject to control by an independent authority. Accordingly, Regulation 
2016/679 regulates all of the responsibilities and powers of supervisory 
authorities. There may be a danger that competition over the enforcement of 
objective data protection law by the supervisory authorities, on the one hand, and 
the civil courts, on the other, would lead to an elimination of the differentiated 
powers of the supervisory authorities and to differences in the enforcement of data 
protection law within the European Union. 
Breach of a consumer protection law within the meaning of Paragraph 2(2)(11) of 
the UKlaG 
41 Clarification is also needed as to whether the qualified entities specified in 
Paragraph 3(1)(1) of the UKlaG have the power, following the entry into force of 
Regulation 2016/679, to pursue breaches of the data protection provisions set out 
in the Regulation on the basis of Paragraph 2(2)(11) of the UKlaG. 
42 One view is that Paragraph 2(2)(11) of the UKlaG should be regarded as the 
anticipatory partial implementation of the provision in Article 80(2) of Regulation 
2016/679. 
43 Another view generally denies any such standing to bring proceedings. On that 
view it is doubtful whether the data protection rules referred to in 
Paragraph 2(2)(11) of the UKlaG – which relate to the rules in the older version of 
the Bundesdatenschutzgesetz (Federal law on data protection) that were repealed 
with effect from 25 May 2018 and do not correspond to the provisions of the new 
version of the Federal law on data protection which have applied since – meet the 
EU’s legal requirements on a consumer protection law. At least no legal basis 
under EU law is to be found in Directive 2009/22/EC on injunctions for the 
protection of consumers’ interests. 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-319/20 
 
10  
Use of invalid general terms and conditions according to Paragraph 1 of the 
UKlaG 
44 Finally, the question arises whether, following the entry into force of Regulation 
2016/679, the applicant has the power to enforce the data protection provisions set 
out in the Regulation by way of an application which is aimed at securing a 
review of a general condition. 
45 According to Paragraph 3 of the UKlaG, qualified entities have a right, in 
accordance with Paragraph 1 of the UKlaG, to seek an injunction against the use 
of general terms and conditions which are invalid according to Paragraph 307 of 
the BGB. 
46 It is not clear whether authorities entitled under Paragraph 3 of the UKlaG, like 
the applicant, are (still) entitled to claim a prohibitory injunction against the use of 
general terms and conditions even after the entry into force of Regulation 
2016/679 if the application is based on the infringement of data protection 
provisions set out in the Regulation. 
47 Thus, it is argued that, given the aim of comprehensive harmonisation pursued by 
Regulation 2016/679, it has to be assumed that the enforcement option for 
associations set out in Article 80(2) of the Regulation is conclusive. Regulation 
2016/679 grants Member States the option, within precisely defined limits, to give 
associations their own power of enforcement independently of any mandate. 
Recourse to rules such as those governing substantive reviews of general terms 
and conditions must therefore, as with the application of reviews under 
competition law, be ruled out in regard to the assessment of data processing 
activities under Regulation 2016/679. Nor are such enforcement options for 
associations necessary any longer, since the German legislature is free to make 
comprehensive provision for the standing of associations to bring proceedings or 
to lodge complaints, through the saving clause in Article 80(2) of Regulation 
2016/679. 
No specific infringement 
48 As has been stated, the lapsing of standing in the course of the appeal on a point of 
law means that the action is inadmissible. Standing to bring proceedings cannot be 
affirmed on the grounds that the provisions under Paragraph 3(1)(1) to 3(1)(3) of 
the UKlaG in conjunction with Paragraph 1 and Paragraph 2(2)(11) of the UKlaG 
are to be regarded as the (anticipatory) implementation of Article 80(2) of 
Regulation (EU) 2016/679 when interpreted in accordance with EU law. 
49 However, it is argued that associations have standing to bring proceedings 
pursuant to Paragraph 3(1)(1) to 3(1)(3) of the UKlaG in respect of breaches 
under Paragraph 2(2)(11) of the UKlaG in so far as the associations meet the 
conditions specified in Article 80(1) of Regulation (EU) 2016/679. 
FACEBOOK IRELAND 
 
11 
50 The applicant’s standing to bring proceedings in the present case cannot be 
assumed on the basis of this argument, however. This is because, even if one 
considered the (anticipatory) implementation of Article 80(2) of Regulation 
2016/679 to be possible in principle according to the view described above, the 
assumption of standing to bring proceedings pursuant to the first sentence of 
Paragraph 3(1) of the UKlaG, when interpreted according to EU law as required 
with respect to Article 80(2) in conjunction with Article 80(1) of Regulation 
2016/679, would be conditional upon fulfilment of the requirements to which the 
legislature made the Member States’ conferral of standing on associations subject. 
That is not the case here; the opportunity given to Member States under 
Article 80(2) of Regulation 2016/679 to establish the possibility of legal 
protection for associations includes only those legal remedies by which a body, 
organisation or association can object to the infringement of the rights of a data 
subject under the Regulation as a result of the processing. 
51 These conditions have not been met. It may admittedly be claimed that there has 
been an infringement in relation to the processing of data within the meaning of 
Article 4(2) of the Regulation. However, the applicant is not claiming any 
infringement of the rights of a data subject within the meaning of Article 80(2) of 
the Regulation. The subject of the claim for relief is instead the abstract 
assessment of the presentation of the App Centre by the defendant by reference to 
the objective legal standard of data protection law without the applicant having 
argued that rights of an identified or identifiable natural person within the 
meaning of Article 4(1) of Regulation 2016/679 have been infringed.