On 18 June 2024 the Amsterdam appeal court handed down a decision in the class action between The Privacy Collective (TPC) and Oracle and Salesforce that provided some more much needed guidance on various topics that are still under debate in the Dutch class action universe.
The case concerns the first big collective claim for damages under the new class action regime, the so-called WAMCA (Wet Afwikkeling Massaschade in Collectieve Actie) that has been started in 2020. It is brought on behalf of approximately 10 million Dutch internet users, for the unauthorized use of their personal data by Oracle and Salesforce. These entities – allegedly – collect personal data by placing a cookie on the users appliance. The extracted data is then enriched with other data to build a detailed profile of the user, which is then sold to advertisers in a process called Real Time Bidding. TPC is claiming € 5 billion in non-tangible damages (i.e. moral prejudice, or loss and suffering for the privacy breaches) from Oracle and Salesforce each (€ 10 billion in total).
‘Likes’ show support for the class action
The case initially made headlines, but for the wrong reasons because TPC was found inadmissible as a collective representative in December 2021 for not demonstrating actual support by its class.
A requirement under the Dutch class action regime is that the collective representative must enjoy and demonstrate ‘actual support’ from the class it purports to represent. Usually, this support is garnered through a book-build that invites class members to register with the foundation and – often – sign a participation agreement. TPC had, however, chosen to demonstrate its active support for the proceedings by having visitors of its website click a ‘thumbs-up’ button (a ‘like’). Besides an IP-address, no personal data was stored. Additionally, TPC had garnered support from various privacy and consumer organizations.
The district court did not consider this sufficient evidence of actual support. Because TPC did not register the data of the ‘likes’ it could not be determined whether the ‘liker’ belonged to the class or not. TPC further provided insufficient information about the class action on the webpage to even be sure that the ‘like’ actually supported the class action against Oracle and Salesforce. The support by the various privacy and consumer organizations did not sway the decision in TPC’s favor as those organizations themselves were not part of the class that TPC represented.
In its recent decision, the appeal court judges differently. The appeal court considers that under the WAMCA, which has introduced an ‘opt-out’ regime, a registration with a foundation (which has more similarity with an ‘opt-in’ regime) is not required. The ‘likes’ show that the class action is supported by a small but sufficient number of people. Importantly, TPC had by now added information to its website that sufficiently informed visitors what the class action is about and who the defendants are.
Further, the appeal court finds that the support of privacy and consumer organizations, who have a proven track record that TPC does not have, shows that internet users consider the use of their personal data for commercial gain problematic. Support of these organizations is therefore relevant for TPC’s suitability as collective representative.
The decision is likely a great relief for TPC as they have managed to turn around the ruling in first instance. It remains to be seen, however, whether future claim vehicles will chose to garner support in a similar way. It is certainly cheaper and arguably more efficient, but still seems fraught with danger and will certainly raise questions from the defendant, if not the court. Given that a representative’s admissibility is at stake, it seems safer to stick to common practice and perform a book-build to ensure that there is an active group of identifiable participants, with whom the foundation is in direct contact, when the admissibility is assessed.
Collective redress for non-tangible damages (i.e. moral prejudice)
Finally, the recent decision also has implications for the collective redress of non-tangible damages. Another admissibility requirement for class actions is that the legal basis for the claims must be sufficiently similar to justify collective redress.
In a recent decision in an ongoing collective action against TikTok, the district court of Amsterdam held that claims for non-tangible damages can not be dealt with collectively, due to the personal nature of the claim.
Now, in the Oracle and Salesforce case, the appeal court has found that although the mere use (i.e. without additional circumstances) of personal data does not justify a claim for non-tangible damages, the legal basis of such a claim is common for the entire class and can therefore be dealt with collectively. It is not necessary that the damages have been suffered to the same extent. Indeed, part of the class may not have suffered any non-tangible damages at all because they do not mind, or may even support the unauthorized use of their personal data in return for personalized ads. The WAMCA explicitly allows compartmentalization of the class into sub-classes. TPC is therefore found admissible in its claim for non-tangible damages.
As the appeal court emphasizes, the decision does not mean that (any part of) the class represented by TPC is actually eligible for compensation of non-tangible damages, but it does mean that such claims can not be thrown out a priori for lack of commonality (as has been done in the TikTok case).
Whether TPC will be able to demonstrate that any part of its class has suffered non-tangible damages, remains to be seen. But the decision re-opens the door for such collective claims that had previously been thrown shut by the TikTok-decision.
