A French nongovernmental organization wants Facebook Inc. to pay 100 million euros ($113 million) and fix any problems stemming from recent data security incidents and privacy breaches.

The Internet Society of France, a public interest group that advocates for online rights, sent a formal notice to Facebook and its subsidiaries Instagram and WhatsApp, warning that it’ll launch an EU-based group action if the company doesn’t secure user personal data effectively.

The threat of a group action is the latest in what’s been a legally murky year for Facebook, which has faced host of privacy and security issues from the Cambridge Analytica scandal to recent data breaches impacting millions of users worldwide.

Facebook was hit with a symbolic fine of 500,000 pounds ($649,000) for its role in the scandal involving Cambridge Analytica, the political firm hired by President Trump’s 2016 presidential campaign that gained access to the private data of millions of Facebook users. It is under investigation by the Irish Data Protection Commission for a recent data breach.

The Internet Society of France says Facebook collected data on nonusers without getting their consent, and illegally limited its responsibilities with respects to personal information. The NGO also claimed that Facebook unduly collected the political opinions, religious beliefs, and sexual orientation of its users in violation of EU privacy laws.

Past privacy failures at Instagram and WhatsApp help bolster the case that the social media giant isn’t following EU privacy law, the NGO said in its notice.

The group is relying on the EU’s General Data Protection Regulation, which took effect May 25. The strict privacy law allows EU citizens to use group actions, similar to a U.S. class action, to go after allegedly infringing companies across borders. The Internet Society claims against Facebook aren’t the first group action but demonstrate the possible future legal risks for digital companies operating in the EU.

The Internet Society is seeking 100 million in euros from Facebook if they can get 100,000 EU data subject to join the complaint. The group cited the millions of EU users impacted by Facebook’s privacy issues to backup its numeric goal.

The organization said Facebook has four months to respond before it files its action in the Court of First Instance of Paris. Such a move would formally launch legal proceedings, but the group and Facebook could reach a settlement before then.

A Facebook spokesperson told Bloomberg Law in an email that it hasn’t received any legal filings related to the Internet Society. The social media giant’s approach to privacy and the GDPR complies with the law and it follows industry best practices as well, the spokesperson said.

—With assistance from Lydia Beyoud