Class Action Regime for Data Protection Violations Adopted in France

France recently passed a “21st Century Modernization of the Judiciary Law,” creating a new general framework for class actions in France to include data protection violations, regardless of industry sector. Class actions have previously only been limited to consumer actions. Pursuant to the new law, data protection class actions may be brought by the following groups: (i) associations whose purpose is the protection of personal data and privacy; (ii) specific national consumer protection associations; and (iii) trade unions. These groups can file class actions before civil or administrative courts.

TIP: Although it is groundbreaking that class actions are now permissible under French law for data protection regulations (as well as discrimination and environmental law pursuant to the same legislation), conditions for bringing them remain restrictive and remedies are limited. For example, individuals may not seek financial compensation, but can obtain injunctive relief. The move is still, however, a reminder that French government is highlighting the importance of data protection.