This landmark ruling is turning the tables on Big Tech

While ‘admissibility’ is only a preliminary win, it’s an important one: the Court of Appeals found that TPC did not require to engage in an extensive ‘bookbuild’ process and register the support of the millions of potential claimants. Such a process is time-consuming and costly and would strongly resemble an ‘opt-in’ class mechanism that goes further than what the law requires and would in effect discourage – if not preclude – civil society actors from engaging with collective redress mechanisms. 

Although The Court attached value to the number of people that subscribed to TPC’s action, it also found that there was no minimum number of people required to initiate a class action and be representative of a group of consumers. 

In reaching this decision, the court also recognized the strong support from civil society for this case as an important factor in substantiating the public interest. The overwhelming support from a wide range of Dutch civil society organisations including digital rights organisations like Bits of Freedom, Privacy First and the Dutch Consumers Association (Consumentenbond) added to the Court’s judgement that TPC has satisfied the so-called ‘representativeness test’. 

This preliminary ruling sets an important precedent in the Netherlands and Europe for public interest mass litigation, securing access to justice for potentially millions of Dutch citizens. 

Femke Hendriks, the chairperson for TPC, called the decision an “absolute milestone for access to the law and the protection of fundamental privacy rights of all Dutch internet users. After all, it is not possible for individual internet users to effectively stand up against violations of online privacy rights”.

Where large tech corporations are involved, these harmful data practices are relatively commonplace and occur in the shadows without individual’s knowledge, which is a significant barrier to litigation and allows tech giants to often get away with exploiting unsuspecting users’ data. 

Much like consumer rights, collective redress claims like the one brought by TPC under WAMCA provide effective legal protection against large scale privacy violations that would otherwise be lacking.

Last month, Oracle settled a $115 million lawsuit in the US for violating the privacy and misusing the data of American users. Oracle has also since announced plans to exit the ad tech business entirely later this year. The settlement and exit announcement highlight industry wide issues, that companies must treat privacy risks as business risks that could impact their bottom line, and not as an afterthought.

Following the first hurdle on ‘representativity’, one of the most crucial questions in the  merits phase, is whether it is possible to obtain compensation for so-called ‘immaterial damages’ under the EU’s General Data Protection Regulation (GDPR).

This question – essentially, how one defines the damage caused by a privacy breach, and what level of compensation it entails – is currently an ongoing debate in European law. and the Amsterdam Court of Appeal has left open the possibility of referring these questions to the European Court of Justice. 

In the interim however, this judgement has found that the current unknowns surrounding this question is not an obstacle for standing and does not prevent organisations like TPC from being admissible. Following the court management hearing of 5 August 2024, we have yet to see whether Oracle and Salesforce will be allowed to appeal the decision with the Dutch Supreme Court. 

The Netherlands is at the forefront of a wider European trend towards collective redress and this case is an important precedent for the future of such claims.  We welcome this decision by the Amsterdam Court of Appeal to broaden access to justice in the public interest, and for the voices of civil society that came out in support of this case.