Private Law Theory

ABSTRACT
Collective actions are gaining traction in the EU, yet the main instruments governing data, consumers and AI remain structurally misaligned with how algorithmic systems generate harms. This paper identifies an ‘EU collective redress gap’ for harms to algorithmic ‘groups of persons’. It uses doctrinal comparison of the GDPR, the Representative Actions Directive (RAD) and the Artificial Intelligence Act (AI Act), complemented by case studies of TPC v Oracle/Salesforce and the CJEU’s Meta Platforms Ireland (C-319/20) judgment, to showcase this gap. The analysis demonstrates that GDPR remedies are ultimately bound to identifiable data subjects and (optionally) their mandates, RAD ties redress to consumers, and the AI Act, while repeatedly referring to ‘persons or groups of persons’ in its risk-based prohibitions and obligations, outsources collective enforcement to RAD and offers only individualised complaints. On that basis, the paper conceptualises three group categories, organised, inferred and legislatively ‘vulnerable’ groups, and identifies inferred, risk-exposed groups constructed from anonymised data as the main harm-bearers currently left without meaningful access to compensation. To close this gap, this paper proposes a guide for ‘group-friendly’ collective redress consisting in privileging opt-out models, lowering representativeness thresholds (including digital expressions of support), importing WAMCA-style categorisation of claimants, introducing an explicit AI-specific representation right for ‘persons or groups of persons’, and extending collective standing to non-consumer groups. These design options would realign GDPR, RAD and the AI Act ensuring digital fairness and making group-level harms operational.

Nikiforov, Liubomir, Closing the EU Collective Redress Gap: GDPR, RAD and the AI Act for Algorithmic Harms and Digital Fairness (November 25, 2025).