Much coverage of the General Data Protection Regulation has focused, understandably, on the potentially gigantic fines that might be levied on companies and non-compliant data controllers.
But an issue which hasn’t had much focus here is the question of class actions, where the rights of large numbers of citizens (data subjects in the digital lingo) have been breached.
Legal experts are of the view that if national legislation on data protection regulation currently being drafted does not implement two optional parts of it relating to representation in so-called class actions, the downstream impact will be felt in lengthy court lists.
The situation where hundreds of cases are pending in the courts here against Volkswagen Group over the emissions scandal might be dwarfed by a data breach involving the health or financial records of thousands of people, for example.
In a submission to the Joint Oireachtas Committee on Justice on the general scheme of the Data Protection Bill, which will implement the EU regulation, Digital Rights Ireland said there were "practical and principled reasons" for implementing the optional provisions.
Chair of the group Dr TJ McIntyre said if individuals were not able to nominate a representative body to bring an action for damages on their behalf, there would be “a multiplicity of claims being brought...that the courts simply are not equipped to address”.
The other optional provision allows not-for-profits to bring an action on their own initiative even where no individual has come forward.
“Individuals who find sensitive medical records leaked, for example, or like with the Ashley Madison case, those who find information relating to their sexual life has been leaked, would be very often unwilling to become the public face of the issue for very understandable reasons,” Dr McIntyre said.
Separately, a high-profile case involving a worldwide "privacy class action" against Facebook by Austrian lawyer Max Schrems opened yesterday before the Court of Justice of the European Union.
It centres on two questions: whether Mr Schrems is a private individual with consumer status to take such an action, and whether he can he bring a class action in Austria even though many of the other claimants are based elsewhere in the EU. A final judgment is expected by the end of the year.
