Under the new law of 18 November 2016 on the modernisation of justice for the 21st century a new article 42 has been added to the French data protection act (DPA).

This addition provides that a class action can take place where several individuals are placed in a similar situation and suffer loss arising from a breach of the DPA by a data controller or data processor. Such an action can only ensure the cessation of that breach and individuals cannot obtain damages.

The new article 42 may be exercised by certain data protection or consumer associations as well as trade union organisations on behalf of employers or civil servants.