Uncertainty over Dutch privacy class action risk ‘to persist for years’

Amsterdam-based Wouter Seinen of Pinsent Masons was commenting following a ruling by the Amsterdam Court of Appeal on Tuesday.

The Amsterdam court ruled that a district court in the Netherlands can begin to consider the merits of claims raised against two technology providers, despite the fact that the question of whether the claims are admissible has still to be settled.

The underlying case concerns claims raised by The Privacy Collective (TPC), which has accused Oracle and Salesforce of engaging in unlawful collection and use of personal data. It is seeking to bring a collective action against the companies on behalf of millions of Dutch internet users, with funding for the litigation being provided by a third-party. Oracle and Salesforce dispute the claims against them.

Article 80 of the GDPR provides data subjects with a right to mandate not-for-profit bodies, organisations or associations to pursue claims for compensation on their behalf, provided those bodies, organisations or associations are properly constituted in the relevant EU member state, have statutory objectives which are in the public interest, and are active in the field of the protection of data subjects' rights and freedoms with regard to the protection of their personal data.

Article 80 further provides EU member states with the option of enabling such bodies, organisations or associations to take legal action on data subjects’ behalf if the bodies, organisations or associations believe those individuals’ data protection rights have been infringed as a result of data processing, regardless of whether they have a data subject's mandate to do so or not.

It has yet to be established in this case whether TPC’s collective action is admissible, in the context of Article 80. The Amsterdam Court of Appeal considered, however, that even though that fundamental question has still to be settled, it was open to it under Dutch law to refer the case back to the lower district court in Amsterdam for it to hear arguments and rule on the merits of the claims.

However, the Amsterdam Court of Appeal simultaneously said that it would allow its ruling to be appealed to the Dutch Supreme Court.

Seinen said that if an appeal follows, under the terms of the Dutch civil code, it would have the effect of putting a pause on the district court proceedings until such time as the appeal process concludes. That, he explained, could take years.

“The core questions this case raises are the extent to which bodies like the TPC can be said to have a mandate from Dutch data subjects to pursue data protection-related compensation claims, and whether collective actions are the right vehicle for such claims to be pursued where the circumstances of each data subject in the apparent collective are highly individualised,” Seinen said.

“If an appeal is lodged against the Amsterdam Court of Appeal, these matters will fall to be considered by the Dutch Supreme Court, though the Amsterdam Court of Appeal has implied that as matters of EU law interpretation are at stake, the help of the EU’s highest court, the Court of Justice of the EU (CJEU), may need to be enlisted in that regard,” he said.

“In such circumstances, it would be years before the CJEU and Dutch Supreme Court provide certainty on the extent to which data protection-related collective actions are admissible in the Netherlands, and that is before other substantive matters pertaining to the merits of such claims – like whether any damage giving rise to compensation rights under the GDPR can actually be evidenced – would fall to be considered. In the short term, the lack of certainty in this area could have a chilling effect on claims funders in terms of their appetite for bringing data protection-related mass claims in the Netherlands,” Seinen said.