BVwG - W292 2342582-1/13E
German court rules data protection complaints filed for financial gain are invalid.
A German court has ruled that data protection complaints filed by an association, whose business model relies on litigation funding and a profit-sharing agreement with data subjects, are invalid. The court found that the complaints were not lodged for the genuine protection of personal data but for financial gain, citing Article 57(4) GDPR. The association's systematic filing of over 900 similar complaints was deemed an abuse of data subject rights.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Article 15 GDPR?
Get an email when a new story names Article 15 GDPR, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn Austrian court ruled that a litigation-funding association's mass filing of over 900 GDPR complaints was an abuse of data subject rights under Article 57(4) GDPR, as the complaints were motivated by financial gain rather than genuine data protection concerns. This case highlights how GDPR complaint mechanisms can be exploited by third parties with commercial interests, undermining the integrity of data protection enforcement. Organizations must understand that not all GDPR complaints are filed in good faith, and regulators are empowered to dismiss those that constitute procedural abuse. It also serves as a reminder that legitimate compliance efforts require organizations to distinguish between genuine data subject rights and commercially-driven litigation strategies. Robust internal data protection governance remains essential to withstand scrutiny from any source.