Civil Society Actors as Enforcers of the GDPR: What Role for the CJEU?

Abstract

This article examines the interaction between the CJEU and civil society actors in data protection cases. It first reflects on the role of such actors in legal actions concerning the protection of personal data before national and EU courts, stressing their key potential to address power imbalances between individuals and Big Tech companies. Then, it critically assesses the CJEU’s contribution to fostering the role of civil society in the GDPR enforcement. It demonstrates that non-governmental organizations are excluded from participation in infringement proceedings against Member States for failing to fulfil their obligations under the GDPR, which can be launched by the Commission under Article 258 TFEU. Furthermore, such organizations cannot bring direct actions against the Commission’s delegated and implementing acts due to the lack of standing under Article 263 TFEU. Additionally, civil society actors have a limited possibility to intervene as third parties in the legal proceedings before the CJEU. Yet this article contends that a greater involvement of these actors in legal proceedings before the CJEU is key to enhancing its responsiveness to the demands of civil society. It therefore reflects on the ways to make the CJEU a more effective avenue for legal mobilization in the field of data protection.