Competitors May Challenge GDPR Infringements As Unfair Commercial Practices

On October 4, 2024, the Court of Justice of the European Union (CJEU) issued a significant judgment (Case C-21/23) regarding the ability of competitors to bring proceedings against organizations that infringe the General Data Protection Regulation (GDPR) based on the prohibition of unfair commercial practices. This case originated from a German court, where a competitor filed a civil proceeding against an organization on the basis of the prohibition of unfair commercial practices, in respect of infringements by that organization of the provisions of the GDPR. The CJEU was asked to determine whether the GDPR prevents EU Member States from adopting laws that allow competitors to bring civil actions against organizations for GDPR infringements based on unfair commercial practices. In an era where data is increasingly viewed as a competitive asset and regulatory frameworks are becoming more stringent, this judgment is expected to have far-reaching implications and