.png)
Opinion & analysis
13 August 2024
This landmark ruling is turning the tables on Big Tech
As part of its Strategic Initiatives programme, Luminate supports litigation that challenges unlawful data practices by large tech companies and seeks remedies for harms to those affected.
This work aims to hold tech giants accountable for their role in abusing people’s data: the keystone to platforms’ increasing power over our societies and democracies.
But this is a challenging and emerging field – in Europe, where tech regulation is the most advanced, the potential for American style ‘class action’ lawsuits is starting to increase thanks to recent EU legislation, the Representative Actions Directive, through which large groups of citizens and consumers can seek collective redress and compensation for harms in the platform economy.
This has raised some difficult questions for courts to rule upon, for example:
- Who can represent a class of affected persons whose data was mishandled, and which requirements do they have to meet?
- How do we understand ‘harm’ when tech corporations are surveilling your every move without your knowledge?
- What is the possibility of claiming compensation for the harm that arises from the abuse of your data?
Luminate is funding the Dutch non-profit organisation, stitching The Privacy Collective (TPC), to support litigation that promises to bring justice and redress for violations of people’s data rights and privacy.
The Amsterdam Court of Appeals recently issued a landmark decision declaring TPC as ‘admissible’ in its mass claim against tech giants Oracle and Salesforce for exploiting the data of over 10 million internet users in the Netherlands. The Court found that TPC meets the legal requirements for representativeness that allows them to proceed with their lawsuit, overturning a previous judgement in the lower court.
The case was filed against Oracle and Salesforce for their allegedly unlawful use of cookies and data processing at scale to profile and target ads to Dutch citizens without their consent or proper knowledge them of the processing. It is one of the first claims to be brought under the Netherlands’ new WAMCA law, which allows a collective of plaintiffs to recover monetary damages through an ‘opt-out’ class action mechanism. Class action lawsuits were already possible in the Netherlands, but not for monetary compensation and the new law was intended to open up access to justice for large groups of plaintiffs seeking redress for large scale violations.
A crucial win for access to justice
While ‘admissibility’ is only a preliminary win, it’s an important one: the Court of Appeals found that TPC did not require to engage in an extensive ‘bookbuild’ process and register the support of the millions of potential claimants. Such a process is time-consuming and costly and would strongly resemble an ‘opt-in’ class mechanism that goes further than what the law requires and would in effect discourage – if not preclude – civil society actors from engaging with collective redress mechanisms.
Although The Court attached value to the number of people that subscribed to TPC’s action, it also found that there was no minimum number of people required to initiate a class action and be representative of a group of consumers.
In reaching this decision, the court also recognized the strong support from civil society for this case as an important factor in substantiating the public interest. The overwhelming support from a wide range of Dutch civil society organisations including digital rights organisations like Bits of Freedom, Privacy First and the Dutch Consumers Association (Consumentenbond) added to the Court’s judgement that TPC has satisfied the so-called ‘representativeness test’.
Significance for privacy claims
This preliminary ruling sets an important precedent in the Netherlands and Europe for public interest mass litigation, securing access to justice for potentially millions of Dutch citizens.
Femke Hendriks, the chairperson for TPC, called the decision an “absolute milestone for access to the law and the protection of fundamental privacy rights of all Dutch internet users. After all, it is not possible for individual internet users to effectively stand up against violations of online privacy rights”.
Where large tech corporations are involved, these harmful data practices are relatively commonplace and occur in the shadows without individual’s knowledge, which is a significant barrier to litigation and allows tech giants to often get away with exploiting unsuspecting users’ data.
Much like consumer rights, collective redress claims like the one brought by TPC under WAMCA provide effective legal protection against large scale privacy violations that would otherwise be lacking.
Last month, Oracle settled a $115 million lawsuit in the US for violating the privacy and misusing the data of American users. Oracle has also since announced plans to exit the ad tech business entirely later this year. The settlement and exit announcement highlight industry wide issues, that companies must treat privacy risks as business risks that could impact their bottom line, and not as an afterthought.
What happens next – in the Netherlands and in Europe?
Following the first hurdle on ‘representativity’, one of the most crucial questions in the merits phase, is whether it is possible to obtain compensation for so-called ‘immaterial damages’ under the EU’s General Data Protection Regulation (GDPR).
This question – essentially, how one defines the damage caused by a privacy breach, and what level of compensation it entails – is currently an ongoing debate in European law. and the Amsterdam Court of Appeal has left open the possibility of referring these questions to the European Court of Justice.
In the interim however, this judgement has found that the current unknowns surrounding this question is not an obstacle for standing and does not prevent organisations like TPC from being admissible. Following the court management hearing of 5 August 2024, we have yet to see whether Oracle and Salesforce will be allowed to appeal the decision with the Dutch Supreme Court.
The Netherlands is at the forefront of a wider European trend towards collective redress and this case is an important precedent for the future of such claims. We welcome this decision by the Amsterdam Court of Appeal to broaden access to justice in the public interest, and for the voices of civil society that came out in support of this case.