GDPR Mass Litigation

Lukas Feiler, CIPP/E, Partner, Baker McKenzie

Defending against tens or hundreds of similar or identical claims in as many parallel proceedings presents unique strategic and operational challenges. Using real-world examples, this session will examine three major scenarios for a GDPR mass litigation:

• A single data subject (indirectly) taking action against a company by seeking legal redress against thousands of the company's customers. 
• Tens of plaintiffs represented by the same attorney filing the same or similar lawsuits against the same defendant. 
• Hundreds of (only loosely coordinated) data subjects filing similar complaints against the same controller. 

The parallel nature of the proceedings, often civil proceedings, will run in parallel with administrative proceedings before data protection authorities and, potentially, even ex-officio investigations by a data protection authority. Which cases should be pushed in which jurisdiction and how does each branch of the mass litigation affect the other branches? Can the outcome of an administrative proceeding be binding for a civil proceeding? 

What you will learn:

• Types of privacy mass litigations in practice. 
• Which cases to push in which jurisdiction and how each branch of the mass litigation affects the other branches. 
• Practical tips for managing a mass litigation with 500+ proceedings.