Currently, Irish law makes no provision for "class" or collective actions.
Generally speaking, where class actions are available (for example the United States) a class action lawsuit involves a scenario whereby a group of plaintiffs are represented en masse at trial by a member of that group. In most cases, the court will order that the class of people affected by the suit are to be notified and they will automatically be part of the case - unless they specifically choose to opt out. Class actions are a common and cost effective method for multiple parties to litigate a claim. They are particularly useful in that they allow all claims of a particular affected group to be litigated at once, crucially, whether or not each member of that group knows that they have suffered damage.
Article 80 of the General Data Protection Regulation ("GDPR") allows for three different mechanisms pursuant to which an entity may exercise a data subject's rights on his or her behalf, namely:
- A joint representative action, whereby data subjects have the right to mandate a not-for-profit body, organisation or associate ("an Authorised Entity") to make a complaint on their behalf to the relevant supervisory authority (being the Data Protection Commission in Ireland ("DPC"));
- A compensatory representative action, whereby data subjects have the right to mandate an Authorised Entity to exercise their right to receive compensation on their behalf, where provided by Member State law; and
- A limited class action, whereby an Authorised Entity may, without a data subject's consent or authority, lodge a complaint with the DPC on that data subject's behalf.
Ireland has transposed, pursuant to the Data Protection Act 2018 ("the Act"), mechanisms 1 and 2 above, but not no. 3, limited class actions. Therefore, whilst the Act does not see the introduction of a GDPR class actions in Irish law, it does allow for a limited, more restricted form of representative collective action whereby specific Authorised Entities (i.e., non-for-profit organisations), with the data subjects' consent, can make consolidated complaints on their behalf to the DPC and seek compensation on their behalf. This should pave the way for a cost effective means by which data subjects may vindicate their rights under the GDPR.
The limited class action system (no. 3 above) is closest to a US-style class action in that the affected party does not need to give his or her consent to the action. This has not been transposed into Irish law, however, if it was, only Authorised Entities could make the complaint on the affected party's behalf. This differs from the position in the States, where any affected party may take the case on behalf of an affected group, not just Authorised Entities. Additionally, and unlike the position in the States, the limited class action mechanism does not allow for compensation to be obtained by the Authorised Entity on the data subject's behalf, as consent has not been given by the data subject. Instead, the Authorised Entity role is limited to making a complaint.