Privacy activists are using the EU's collective redress tool against Big Tech

European digital rights and privacy advocacy groups are using a new legal mechanism, the EU's Collective Redress Directive, to pursue substantial compensation for General Data Protection Regulation (GDPR) violations, potentially costing Big Tech billions. The directive, which came into effect in 2020, allows groups of consumers to collectively seek compensation for damages, with the GDPR being one of the laws it can enforce.

Already, non-profits like SOMI and the Irish Council for Civil Liberties have initiated collective actions against TikTok, Meta, and Microsoft, while NOYB is preparing one against credit ratings agency CRIF. Ursula Pachl, spearheading NOYB's collective redress actions, sees immense potential in this new avenue, particularly for GDPR breaches, given that "everybody in Europe probably suffers from the same illegal behaviour if there is a Big Tech company who does something which doesn't respect the GDPR." Data protection lawyer Guillaume Couneson noted that once a breach is confirmed by a data protection authority (DPA), collective redress actions could proliferate rapidly. A recent landmark ruling by the General Court of the EU Court of Justice awarded €400 in damages to the claimant, setting a precedent that could lead to substantial payouts if applied to millions of affected individuals.