The European Union’s top court Thursday ruled that the consumer protection association may bring representative action against Big Tech over infringements of laws protecting personal data. The ruling by the Court of Justice of the European Union (CJEU) allows the German Federal Union of Consumer Organisations and Associations to seek an injunction against Meta Platforms Ireland in a German court.

The case was initially brought by the Federal Union against Meta Platforms Ireland (formerly Facebook Ireland Limited) before the Federal Court of Justice in Germany over alleged infringement of rules on personal data protection, anti-competitive practices and consumer protection in the context of certain free games provided by third parties on the platform.

While finding the consumer body’s action to be well-founded, the German court had expressed doubts about its admissibility. Thereafter, the German court had referred the matter to the CJEU to adjudicate whether since the coming into force of General Data Protection Regulation (GDPR) in 2018, a consumer body like the Federal Union had the legal standing to initiate action.

The CJEU in the instant case found that the GDPR “does not preclude a consumer protection association from being able to bring legal proceedings” and that it seeks “to ensure harmonisation of national legislation on the protection of personal data which is, in principle, full.”

The press release by the court states that since a consumer protection association, like the Federal Union, pursues public interest for the purposes of the GDPR, it falls within the purview of a “body that has standing to bring proceedings.” The court also opined the consumer body may even bring legal action without first individually identifying the persons whose rights had been violated.

The ruling deals a blow to tech giants as it opens them up to more litigation over their failure to safeguard consumer data.