One of the important questions in data privacy is, if a third party, not being the data subject, can sue controllers e.g. under competition law.
In the actual case a consumer protection association is acting against Facebook. The subject matter is on games in form of apps to be used on facebook. There is a button “play game” and below (!) that button there was a sentence saying that the ‘general information, your email address, on you, your status messages, are stored and that the app may post in the name of the data subject including the score and more’.
There is a decision by European Court of Justice (July 29th, 2019 – C-40/17) that the former data privacy directive 95/46/EU is not hindering associations to sue.
In the moment this question is discussed. Some say that GDPR is final and therefore one can only sue if it is allowed under GPDR. Others say that GDPR is open and base there argument on Art. 80 GPDR, where it is said, that claims by organizations are allowed subject to local law allowing such organizations to sue.
It is now up to the European Court of Justice to verdict if associations can also sue under GDPR (see Art. 80 sec. 1 GDPR and Art. 84 sec. 1 GDPR).