Drawing on scholarship in informational capitalism, this paper argues that large-scale GDPR violations by Big Tech—termed 'business model violations'—generate systemic data harms that require collective action as well as remedies capable of capturing their collective dimension. The paper contends that existing EU instruments—particularly Articles 80 and 82 GDPR and the Representative Actions Directive—already enable such responses, though their potential is underrealised. By bridging legal doctrine and socio-technical critique, the paper reframes collective redress as not merely feasible, but normatively necessary for meaningful enforcement.