Judgment;Summary — ECLI:EU:C:2024:598
Date: 2024-07-11
Language of the case: German
Court formation: Fourth Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Data protection
Procedure: Reference for a preliminary ruling
Origin: Germany

Translation C-757/22 – 1 
Case C-757/22 
Request for a preliminary ruling 
Date lodged: 
15 December 2022 
Referring court: 
Bundesgerichtshof (Federal Court of Justice, Germany) 
Date of the decision to refer: 
10 November 2022 
Defendant and appellant in the appeal on a point of law: 
Meta Platforms Ireland Limited 
Applicant and respondent in the appeal on a point of law: 
Bundesverband der Verbraucherzentralen und 
Verbraucherverbände – Verbraucherzentrale Bundesverband e. V. 
(Federation of German Consumer Organisations) 
  
BUNDESGERICHTSHOF (FEDERAL COURT OF JUSTICE, GERMANY; 
‘BGH’) 
DECISION 
[…]          Delivered on: 
            10 November 2022 
                […] 
                […] 
                […] 
                […] 
in the case of 
Meta Platforms Ireland Limited, […], 
Defendant and appellant in the appeal on a point of law, 
– […] – 
EN 
REQUEST FOR A PRELIMINARY RULING OF 10. 11. 2022 – CASE C-757/22 
 
2  
v 
Bundesverband der Verbraucherzentralen und 
Verbraucherverbände – Verbraucherzentrale e. V., […], (Federation 
of German Consumer Organisations) 
Applicant and respondent in the appeal on a point of law: 
– […] – 
The First Civil Chamber of the Federal Court of Justice […] 
has decided as follows: 
I. The proceedings are stayed. 
II. The following question is referred to the Court of Justice of the 
European Union [(‘CJEU’)] for a preliminary ruling on the 
interpretation of Article 80(2) of Regulation (EU) 2016/679 of the 
European Parliament and of the Council of 27 April 2016 on the 
protection of natural persons with regard to the processing of personal 
data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation; OJ 2016 L 119, p. 1) 
(‘the GDPR’). 
Is an infringement of rights ‘as a result of the processing’ within the 
meaning of Article 80(2) of the GDPR asserted when a consumer 
protection association invokes, in support of its action, infringement of 
a data subject’s rights on the ground of non-compliance with the 
information obligations laid down in the first sentence of Article 12(1) 
of the GDPR, read in conjunction with Article 13(1)(c) and (e) of the 
GDPR, relating to the purpose of the data processing and the recipient 
of the personal data? 
Grounds: 
1 A. The applicant is the Federation of German Consumer Organisations of the 
German Länder, which is included on the list of qualified entities pursuant to 
Paragraph 4 of the Gesetz über Unterlassungsklagen bei Verbraucherrechts- und 
anderen Verstößen (Law on injunctions against infringements of consumer law 
and other infringements; ‘the UKlaG’). The defendant, Meta Platforms Ireland 
Limited (formerly Facebook Ireland Limited), established in Ireland, operates the 
Facebook internet platform at www.facebook.de, which is used to exchange 
personal and other data. A sister company of the defendant, Facebook Germany 
GmbH, established in Germany, advertises there the availability of advertising 
space on the internet platform and supports local advertising clients of the 
defendant. The defendant is the contract partner for advertising clients in 
Germany. It also processes the data of Facebook’s German customers. The parent 
META PLATFORMS IRELAND 
 
3 
company of the defendant and of Facebook Germany GmbH is established in the 
United States of America. 
2 The Facebook internet platform contains an area called the ‘App-Zentrum’ (‘App 
Centre’), in which the defendant makes available to users, inter alia, free games 
provided by third parties. When the App Centre was accessed on 26 November 
2012, the game ‘The Ville’ was being offered there and the following information 
was displayed under a ‘Play now’ button: 
If you click on ‘Play game’ above, this app obtains the following: 
– Your general information (?) 
– Your email address 
– About you 
– Your status reports 
This app may post on your behalf, including your score and other 
information. 
3 The following notice was also to be found there: 
By continuing, you consent to The Ville’s general terms and conditions and data 
protection policy. 
The general terms and conditions and data protection provisions were accessible 
via a link. Similar indications appeared in connection with the games ‘Diamond 
Dash’ and ‘Wetpaint Entertainment’, also under a ‘Play now’ button. The 
information on the game ‘Scrabble’ ended with the following sentence: 
This app may post status reports, photos and more on your behalf. 
4 The applicant takes issue with the presentation of the information supplied under 
the ‘Play now’ button in the App Centre on the ground that it is unfair, inter alia, 
in terms of the failure to comply with the legal requirements that apply to the 
obtention of the user’s valid consent under the provisions governing data 
protection. Moreover, it considers that the final notice in the case of the game 
‘Scrabble’ is a general condition which is unreasonably detrimental to the user. 
5 The applicant applied for an order restraining the defendant, on pain of 
administrative penalties, 
1. from presenting games, in the context of commercial activities aimed 
at consumers permanently resident in the Federal Republic of 
Germany, on the website with the address www.facebook.com, in an 
‘App Centre’ in such a way that, by clicking on a button such as ‘Play 
now’, the consumer makes a declaration enabling the game operator to 
REQUEST FOR A PRELIMINARY RULING OF 10. 11. 2022 – CASE C-757/22 
 
4  
obtain, via the social network operated by the defendant, information 
on the personal data on that website and authorising it to transmit 
(post) information on behalf of the consumer, as shown in the 
screenshots reproduced [not printed here]; 
2. from including the following provisions or provisions with identical 
content in agreements with consumers habitually resident in the 
Federal Republic of Germany concerning the use of applications 
(apps) within a social network, as well as from invoking the provisions 
relating to the transmission of data to the game operators: 
This app may post status reports, photos and more on your 
behalf. 
6 The applicant also claimed from the defendant compensation for the costs of 
giving formal notice amounting to EUR 200 plus interest. It brought the present 
action independently of a specific infringement of a data subject’s data protection 
rights and without being mandated to do so by such a person. 
7 The Landgericht (Regional Court, Germany; ‘LG’) ruled against the defendant, in 
accordance with the application (LG Berlin, ZD 2015, 133). The defendant’s 
appeal was dismissed (KG, GRUR-RR 2018, 115). By way of its appeal on a 
point of law, for which the appellate court granted leave and which the applicant 
seeks to have dismissed, the defendant is further pursuing its application to have 
the claim dismissed. 
8 In a decision of 28 May 2020 (I ZR 186/17, GRUR 2020, 896 = WRP 2020, 
1182 – App Centre I), the Chamber stayed the proceedings and referred the 
following question to the Court of Justice of the European Union for a preliminary 
ruling on the interpretation of Chapter VIII, in particular Article 80(1) and (2) and 
Article 84(1) of the GDPR, to clarify the legal situation under the General Data 
Protection Regulation, which entered into force during the proceedings in the 
appeal on a point of law and which has a prospective effect on applications for an 
injunction: 
Do the rules in Chapter VIII, in particular in Article 80(1) and (2) and 
Article 84(1), of the GDPR preclude national rules which – alongside the 
powers of intervention of the supervisory authorities responsible for 
monitoring and enforcing the Regulation and the options for legal redress for 
data subjects – empower. on the one hand, competitors and, on the other, 
associations, entities and chambers entitled under national law, to bring 
proceedings for breaches of the GDPR, independently of the infringement of 
specific rights of individual data subjects and without being mandated to do 
so by a data subject, against the person responsible for that infringement 
before the civil courts on the basis of the prohibition of unfair commercial 
practices or breach of a consumer protection law or the prohibition of the 
use of invalid general terms and condition? 
META PLATFORMS IRELAND 
 
5 
9 By judgment of 28 April 2022 (C-319/20, […] Meta Platforms Ireland), the Court 
of Justice of the European Union ruled as follows: 
Article 80(2) of the GDPR must be interpreted as not precluding national 
legislation which allows a consumer protection association to bring legal 
proceedings, in the absence of a mandate conferred on it for that purpose and 
independently of the infringement of specific rights of the data subjects, 
against the person allegedly responsible for an infringement of the laws 
protecting personal data, on the basis of the infringement of the prohibition 
of unfair commercial practices, a breach of a consumer protection law or the 
prohibition of the use of invalid general terms and conditions, where the data 
processing concerned is liable to affect the rights that identified or 
identifiable natural persons derive from that regulation. 
10 B. It is apparent from the judgment of the Court of Justice of the European 
Union of 28 April 2022 that the provisions at issue in the present dispute, relating 
to standing to bring proceedings under Paragraph 8(3)(3) of the Gesetz gegen den 
unlauteren Wettbewerb (Law against unfair competition; ‘UWG’) and under 
Paragraph 3(1)(1), read in conjunction with Paragraph 2(2)(11) of the UKlaG, 
must be interpreted in a manner consistent with EU law in the field of application 
of the General Data Protection Regulation, in the light of the conditions laid down 
in Article 80(2) of the GDPR. The question as to whether the applicant, which 
bases its claims on non-compliance with information obligations relating to the 
purpose of the data processing and the recipient of the personal data, is asserting 
its claim on the grounds of infringement of rights ‘as a result of the processing’ 
within the meaning of Article 80(2) of the GDPR hinges on the inconclusive 
interpretation of that provision. Before a decision can be taken on the defendant’s 
appeal on a point of law, the proceedings must therefore be stayed again and a 
preliminary ruling sought from the Court of Justice of the European Union under 
point (b) of the first paragraph and the third paragraph of Article 267 TFEU. 
11 I. The appeal court was right to find that the claims were well founded. For 
the defendant’s appeal on a point of law to be successful, it is therefore relevant 
whether the appeal court was correct in law in proceeding on the basis that the 
action was admissible. That presupposes that, following the entry into force of the 
General Data Protection Regulation, qualified entities, such as the applicant 
consumer association in the present dispute, have the standing to bring 
proceedings under Paragraph 8(3)(3) of the UWG and Paragraph 3(1)(1) of the 
UKlaG before the civil courts for infringements of that regulation, independently 
of any specific infringement of rights of individual data subjects and without 
being mandated to do so by such a person for infringement of Paragraph 3a of the 
UWG, breach of a consumer protection law within the meaning of 
Paragraph 2(2)(11) of the UKlaG or the use of invalid general terms and 
conditions under Paragraph 1 of the UKlaG (BGH, GRUR 2020, 896 (juris 
paragraphs 17 to 32 and 55 to 62) – App Centre I). 
REQUEST FOR A PRELIMINARY RULING OF 10. 11. 2022 – CASE C-757/22 
 
6  
12 II. The applicant’s standing to bring proceedings in the present dispute depends on 
whether, by its action, it claims that the rights of a data subject were infringed ‘as 
a result of the processing’ within the meaning of Article 80(2) GDPR. 
13 1. In its decision to request a preliminary ruling of 28 May 2020, the 
Chamber proceeded from the assumption that, in accordance with German law, 
the applicant’s standing to bring proceedings under Paragraph 8(3)(3) of the UWG 
and Paragraph 3(1)(1) of the UKlaG could not be inferred from the provisions of 
Chapter VIII of the General Data Protection Regulation since its claim was 
directed solely at the objective legal enforcement of data protection law in the 
present case (see BGH, GRUR 2020, 896 (juris paragraph 35) – App Centre I). It 
considered that such standing to bring proceedings cannot be based either on 
Article 80(1) or (2) of the GDPR or on Article 84(1) of the GDPR and that, in the 
light of the wording, context and objective of the General Data Protection 
Regulation, it is doubtful whether it harmonised not only the substantive rules on 
the protection of personal data, but also the enforcement of the rights existing 
under that regulation. It was in that context that the Chamber referred to the Court 
of Justice of the European Union for a preliminary ruling the question whether the 
General Data Protection Regulation laid down exhaustive rules in relation to the 
right of associations to take legal action precluding the applicability in the event 
of a dispute of the provisions laid down in Paragraph 8(3)(3) of the UWG and 
Paragraph 3(1)(1) of the UKlaG (BGH, GRUR 2020, 896 (juris paragraphs 33 to 
54) – App Centre I). 
14 However, the Court of Justice of the European Union decided, in a departure from 
the position taken by the Chamber in its decision to request a preliminary ruling 
(BGH, GRUR 2020, 896 (juris, paragraphs 37, 60 and 62) – App Centre I), that 
the applicant’s standing to bring proceedings can derive from Article 80(2) of the 
GDPR (Court of Justice of the European Union, […] paragraph 49 […] – Meta 
Platforms Ireland). It proceeded on the assumption that that provision gives the 
Member States a discretion with regard to its implementation. In order for it to be 
possible to proceed with the representative action provided for in Article 80(2) of 
the GDPR, Member States must make use of the option made available to them by 
that provision to provide in their national law for that mode of representation of 
data subjects (see CJEU, […] paragraph 59 […] – Meta Platforms Ireland). 
15 On the basis of the decision of the Court of Justice of the European Union, it is 
therefore necessary to ascertain whether the rules at issue in the present case under 
Paragraph 8(3)(3) of the UWG and Paragraph 3(1)(1) of the UklaG fall within the 
scope of the discretion conferred on each Member State by Article 80(2) of the 
GDPR. That discretion must be determined, by way of interpretation, taking into 
account the wording of Article 80(2) of the GDPR and the scheme and objectives 
of the General Data Protection Regulation (see CJEU, […] paragraph 62 […] – 
Meta Platforms Ireland). The possibility offered to the Member States by 
Article 80(2) of the GDPR to provide for a representative action mechanism 
against the person allegedly responsible for an infringement of the laws protecting 
personal data sets out a number of requirements at the level of the personal and 
META PLATFORMS IRELAND 
 
7 
material scope which must be complied with for that purpose (CJEU, […] 
paragraph 63 […] – Meta Platforms Ireland). It is true that, in the present case, the 
requirements relating to the personal scope are satisfied. By contrast, it is 
questionable whether, in the light of the content of the claims at issue, all the 
requirements relating to the material scope of Article 80(2) of the GDPR are also 
fully satisfied. 
16 2. The standing to bring proceedings conferred on the applicant by 
Paragraph 8(3)(3) of the UWG and Paragraph 3(1)(1) of the UklaG falls within 
the personal scope of Article 80(2) of the GDPR. The applicant, as a consumer 
protection association, meets the requirements of Article 80(1) of the GDPR 
relating to the standing of a not-for-profit body, organisation or association to 
bring proceedings (see CJEU, […] paragraphs 65 and 79 […] – Meta Platforms 
Ireland). 
17 3. In the present case, it cannot be established without doubt whether all the 
relevant requirements relating to the material scope of Article 80(2) of the GDPR 
have been fully satisfied. 
18 a) However, the applicant’s standing to bring proceedings cannot be called 
into question by the fact that it brought its action independently of a specific 
infringement of a data subject’s right to protection of his or her data and without 
being mandated to do so by such a person (see BGH, GRUR 2020, 896 (juris 
paragraph 7) – App Centre I; CJEU, […] paragraph 36 […] – Meta Platforms 
Ireland). It is true that the subject matter of the action relates only to an abstract 
legal examination of the defendant’s presentation in its App Centre in the light of 
the objective law on data protection (concerning the claim at issue in the present 
case, see BGH, GRUR 2020, 896 (juris paragraph 62) – App Centre I). However, 
the Court of Justice of the European Union has already held that a body, within 
the meaning of Article 80(2) of the GDPR, cannot be required to carry out a prior 
individual identification of the person specifically concerned by data processing 
that is allegedly contrary to the provisions of the General Data Protection 
Regulation. The concept of ‘data subject’, within the meaning of Article 4(1) of 
the GDPR, covers not only an ‘identified natural person’, but also an ‘identifiable 
natural person’, namely, a natural person who can be identified, directly or 
indirectly, by reference to an identifier such as, inter alia, a name, an identification 
number, location data or an online identifier. In those circumstances, the 
designation of a category or group of persons affected by such treatment may also 
be sufficient for the purpose of bringing such representative action (see CJEU, 
[…] paragraph 68 et seq. […] – Meta Platforms Ireland). The users of the 
Facebook internet platform targeted by the design of the App Centre, who were 
interested in playing one of the games offered there and who could therefore 
potentially, by clicking on the ‘Play now’ button, declare their consent to the 
processing of their personal data, are identifiable natural persons in the above 
sense. 
REQUEST FOR A PRELIMINARY RULING OF 10. 11. 2022 – CASE C-757/22 
 
8  
19 b) Furthermore, the fact that the applicant, by invoking an infringement of the 
rules on the protection of consumers’ personal data, also invokes an infringement 
of other rules intended to protect consumers or to combat unfair commercial 
practices does not preclude the application of Article 80(2) of the GDPR (see 
CJEU, […] paragraphs 66 and 77 to 82 […] – Meta Platforms Ireland). 
20 c) Article 80(2) of the GDPR also presupposes that the applicant association 
invokes infringement of the rights of a data subject under the General Data 
Protection Regulation ‘as a result of the processing’. It is not clear whether that 
condition is satisfied in the circumstances of the present case. The question 
referred seeks to clarify the legal requirements imposed in this context. 
21 aa) The question referred for a preliminary ruling has not already been settled 
by the judgment of the Court of Justice of the European Union of 28 April 2022 in 
the ‘Meta Platforms Ireland’ case, delivered in the context of the present dispute. 
In its judgment, the Court did not comment on the conditions that must be 
satisfied under EU law in order for the rights of a data subject under the General 
Data Protection Regulation to be deemed to have been infringed ‘as a result of the 
processing’. 
22 bb) The interpretation of the concept of infringement of rights ‘as a result of 
the processing’ within the meaning of Article 80(2) of the GDPR is not free from 
doubt. It is already unclear under what circumstances it is to be assumed that there 
is ‘processing’ and, in particular, whether there is such processing in the case of a 
breach of the information obligation at issue in the present case (on this subject, 
see paragraphs 27 to 31). Even if this were to be affirmed, the question arises as to 
whether an infringement occurred ‘as a result’ of the processing within the 
meaning of Article 80(2) of the GDPR (on this subject, see paragraphs 32 to 34). 
23 (1) Under Article 4(2) of the GDPR, ‘processing’ means any operation or set 
of operations which is performed on personal data or on sets of personal data, 
whether or not by automated means, such as collection, recording, organisation, 
structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure 
by transmission, dissemination or otherwise making available, alignment or 
combination, restriction, erasure or destruction. It is apparent from the wording of 
that provision, and in particular from the expression ‘any operation’, that the EU 
legislature intended the concept of ‘processing’ to have a broad meaning. That 
interpretation is borne out by the non-exhaustive nature of the list of operations in 
that provision, expressed in the words ‘such as’ (CJEU, judgment of 24 February 
2022, C-175/20, […] paragraph 35 […] – Valsts ieņēmumu dienests). 
24 (2) In the present case, account must be taken of the fact that the applicant 
asserts that there has been an infringement of the defendant’s obligation to provide 
information as to the purpose and extent of the user’s consent to the processing of 
his or her personal data (BGH, GRUR 2020, 896 (juris paragraph 19) – App 
Centre I; CJEU, […] paragraph 35 […] – Meta Platforms Ireland). 
META PLATFORMS IRELAND 
 
9 
25 The subject matter of the action is the presentation of games in the ‘App Centre’ 
on the defendant’s internet platform and an indication that the app is authorised to 
publish certain personal information of the user on his or her behalf (Court of 
Justice of the European Union, […] paragraph 35 […] – Meta Platforms Ireland). 
The applicant brought its action independently of a specific infringement of a data 
subject’s right to protection of his or her data and without being mandated to do so 
by such a person (BGH, GRLIR 2020, 896 [juris paragraph 7] – App Centre I); 
CJEU, […] paragraph 36 […] – Meta Platforms Ireland). 
26 The action does not therefore concern the question whether the defendant 
infringes a user’s data protection rights at the moment when the user activates the 
‘Play now’ or ‘Play game’ buttons in the App Centre, thus possibly triggering the 
processing of his or her personal data. Similarly, there is no dispute as to whether 
the automated operations relating to a user’s personal data following the activation 
of such a button infringe the user’s rights to the protection of personal data. 
27 (3) According to the Chamber, it is not possible to answer unambiguously the 
question whether the infringement in the present case of the obligation arising 
from the first sentence of Article 12(1) and Article 13(1)(c) and (e) of the GDPR 
to transmit to the data subject information relating to the purpose of the processing 
of personal data and the recipient of the personal data in a concise, transparent, 
intelligible and easily accessible form, using clear and plain language (see BGH, 
GRUR 2020, 896 (juris paragraph 30) – App Centre I), falls under the concept of 
processing within the meaning of Article 4(2) of the GDPR. 
28 ‘Processing’ could require, in the literal sense, a direct, or at least indirect, action 
in relation to personal data […] [legal literature]. An ‘operation’, within the 
meaning of Article 4(2) of the GDPR, could presuppose an action that results in 
something happening to the data or the data being handled, and therefore possibly 
does not involve information obligations in connection with obtaining consent for 
the desired subsequent use of the data […] [legal literature]. The regulatory 
context could also militate against the inclusion of information obligations in the 
concept of processing. The obligations to provide information about the purpose 
and scope of the processing of data envisaged by the controller relate to the stage 
prior to the actual processing of personal data. 
29 On the other hand, having regard to the concept of processing, which must be 
interpreted broadly, the Court of Justice of the European Union has also held that 
it encompasses operations which simply ‘initiate’ data collection and thus an 
operation expressly regarded by the legislature as an example of processing 
(CJEU, […] paragraph 37 […] – Valsts ieņēmumu dienests). The situation at issue 
in the present dispute could be deemed to be equivalent because the presentation 
of the App Centre at issue in the action offered the user the possibility, by simply 
clicking on a button, to trigger directly an operation whereby his personal data 
were processed without any intermediate steps. 
REQUEST FOR A PRELIMINARY RULING OF 10. 11. 2022 – CASE C-757/22 
 
10  
30 Moreover, a broad interpretation appears to be consistent with the objective 
pursued by the General Data Protection Regulation consisting in ensuring 
effective protection of the fundamental rights and freedoms of natural persons 
and, in particular, of ensuring a high level of protection of the right of every 
person to the protection of personal data concerning him or her (see CJEU, […] 
paragraph 73 […] – Meta Platforms Ireland). 
31 Further support for a broad interpretation could be found in the need for the 
controller to fulfil the information obligation at issue in the present case, in 
accordance with Article 13(1) of the GDPR, ‘at the time when personal data are 
obtained’. Given that the information to be communicated is to serve as a basis for 
the data subject’s decision to consent to or oppose the processing of his or her data 
and that that purpose would be jeopardised if he or she did not obtain the 
information until after the beginning of the data collection, that information 
should be provided before the start of the flow of data […] [legal literature]. That 
suggests that the legislature adopted a broad interpretation of the concept of 
collection, which also encompasses the situation prior to commencement of data 
collection in the technical sense. 
32 (4) Even if the information obligation at issue in the present case falls within 
the concept of ‘processing’ within the meaning of Article 4(2) of the GDPR, the 
further question still arises as to whether, in the present case, the applicant is 
invoking an infringement that has occurred ‘as a result of’ the processing within 
the meaning of Article 80(2) of the GDPR. 
33 The use of the expression ‘as a result of’ might suggest that the discretion 
conferred on the Member States by Article 80(2) of the GDPR extends only to the 
creation of legal standing to take representative action to invoke an infringement 
of the rights of a data subject under the General Data Protection Regulation 
resulting from a data processing operation within the meaning of Article 4(2) of 
the GDPR and which is, therefore, subsequent to such an operation. 
34 However, the objective of the General Data Protection Regulation of ensuring 
effective protection of the fundamental rights and freedoms of natural persons 
and, in particular, of ensuring a high level of protection of the right of every 
person to the protection of personal data concerning him or her (see CJEU, […] 
para. 74 – Meta Platforms Ireland) suggests that a right as an association to bring a 
representative action also encompasses the infringement of an obligation arising 
from the first sentence of Article 12(1) and Article 13(1)(c) and (e) of the GDPR 
to provide information on the purpose of the data processing and the recipient of 
the personal data in a concise, transparent, intelligible and easily accessible form, 
using clear and plain language. In that regard, account should also be taken of the 
fact that this information obligation also serves as preparation for the data 
subject’s consent as a primary requirement for the lawfulness of the processing of 
personal data under Article 6(1)(a) of the GDPR. 
META PLATFORMS IRELAND 
 
11 
35 III. The Chamber states, for the sake of completeness, that, in any event, the 
question formulated in its decision to request a preliminary ruling of 28 May 2020 
could arise again, in essence, in the event that the Court of Justice of the European 
Union answers the question referred here to the effect that standing to bring 
proceedings in the present case cannot be validly based on Article 80(2) GDPR. 
[…]