Privacy & Cybersecurity Law Blog

On November 19, 2016, the French government enacted a bill creating a legal basis for class actions against data controllers and processors resulting from data protection violations. The bill, which aims to facilitate access to justice for French citizens, establishes a general class action regime and includes specific provisions regarding data protection violations. These provisions go beyond the class action provisions already in place for consumers by adding, within the context of the French Data Protection Act of 1978 (“Loi Informatique et Libertés”), a right to class actions for data protection violations regardless of industry sector.

In practice, in accordance with the new law, class actions can now be initiated before civil or administrative courts in France when several individuals in a similar position incur damages resulting from a data controller’s or data processor’s infringement of its obligations under the French Data Protection Act of 1978. Although the new class action right does not allow individuals to seek financial compensation, it does allow litigants to obtain injunctive relief. This new class action framework for data protection, which follows the German example, will result in enhanced scrutiny of the information practices of companies operating in France and a brighter spotlight on those companies that fail to comply with data protection law. Together with the changes to French data protection law ushered in by the recent Digital Republic Bill, the French government is sending a clear signal to companies regarding the importance of data protection as the compliance deadline for the GDPR approaches.