Noyb approved as ‘Qualified Entity’ to impose injunction or redress measure

The Austrian privacy advocacy group Noyb has been approved as a so-called ‘Qualified Entity’ so it can impose an injunction or redress measures throughout the European Union (EU).

In the United States, every commercial and nonprofit organization is allowed to bring a class action before a judge. In the EU on the other hand, nonprofit organizations have to be approved by member states to interact as a ‘Qualified Entity’, meaning they can hand out an injunction against companies, or launch a class action lawsuit on behalf of millions of Europeans.

Injunctive measures implies that a Qualified Entity is allowed to send a request to a company, demanding it to stop certain illegal practices. This includes tracking users without valid consent, using dark patterns to gain consent, and selling personal data without a proper legal basis.

Typically, a Qualified Entity reaches out to a company asking to stop an illegal activity with a cease and desist letter. If that doesn’t stop the infringement, the Qualified Entity can file a case against the company in any member state.

“Injunctions have been successfully used by consumer organizations for decades when it comes to unfair contract terms or commercial practices. The new EU law now allows Noyb to also use such injunctions when it comes to GDPR violations or other consumer protection infringements, and we all know there are thousands of them,” Noyb’s Head of Collective Redress Ursula Pachl states.

For past and ongoing violations for any unlawful data processing, a Qualified Entity can redress a case. This means it can launch a class action lawsuit in any member state and claim non-material damages on behalf of a large group of victims.

“For an individual consumer, it is usually too difficult and not worth it to bring a lawsuit over €200 against some Big Tech company. However, if millions of affected users group together, the dynamics quickly turn and the costs and risks for every individual user become manageable. This is exactly the power of collective redress actions,” Pachl adds.

Noyb sought approval as a Qualified Entity in both Austria and Ireland. Why these countries? Simple: Austria because that’s where Noyb’s office is located, Ireland because of the large number of headquarters of international tech companies.

Noyb Chairman Max Schrems says it has been a long and rigid process to get the approval. “This will now allow us to bring injunctions against any company that violates the GDPR on the EU market. In addition, we can also form EU 'class actions' where thousands or millions of users can seek damages if their personal data was abused,” he says in a statement.

Noyb plans to bring the first class actions in 2025.