Class actions in which damages can be awarded on a collective basis are still a relatively new phenomenon in Europe, with the UK, Portuguese and Dutch opt-out collective action regimes seen as frontrunners. It has dawned on policymakers and lawyers alike that damages can be suffered across a broad and disparate group of victims, which makes it less likely that compensation will ever be sought and granted. Opt-out collective actions have been introduced to address this issue.
However, such new rules incubate and grow in existing legal frameworks built on years of experience. It can be difficult for courts to find the right balance between the realisation of the policy objectives behind collective actions and the existing legal concepts with which they are familiar. In the UK, this led initially to the Competition Appeal Tribunal imposing a high bar for certification of an opt-out action in the Merricks v Mastercard case. However, this was ultimately overturned by the UK Supreme Court, in a judgment that was seen as watershed moment significantly lowering the initial certification hurdle that CPO applicants must overcome.
In the Netherlands, one of the pioneering collective actions, The Privacy Collective (TPC) v Oracle and Salesforce, equally ran into difficulties at the admissibility stage of the proceedings. In its recent ruling in the case, the Amsterdam Court of Appeal clarified important questions on the admissibility requirements in the Dutch Settlement of Mass Damage in Collective Action Act (WAMCA). In this blog, we address the most important aspects of this judgment and its broader implications.
Facts of the case
TPC filed a collective action on behalf of an estimated 10 million internet users living in the Netherlands for alleged privacy violations related to the placement of cookies and use of the users’ profiles for targeted advertising. TPC claimed injunctions, prohibitions, declarations of law and an amount of €500 per user as compensation for the damage allegedly suffered by users.
However, before being able to represent such a class of potential victims, an entity like TPC must show to the competent court (here, the District Court of Amsterdam) that it is admissible to represent them. For such collective actions, an entity like TPC must meet specific requirements laid down in the WAMCA, which includes a need to show that it is representative of the alleged victims it intends to represent, and certain governance requirements.
The Amsterdam District Court had at first instance declared TPC inadmissible because these requirements had not been fulfilled. TPC appealed this ruling and made several adjustments in its organizational structure to meet these requirements. This post discusses what happened at the Court of Appeal.
The judgement of the Amsterdam Court of Appeal
Assessment at the time of the hearing (ex nunc)
A first point to note is that the Amsterdam Court of Appeal assessed ex nunc (i.e. at the time of the hearing of the appeal) whether TPC has met the admissibility requirements, as opposed to ex tunc (i.e. at the time of filing the claim). Therefore, in its assessment, the Court of Appeal could take the adjustments TPC had made (appointment of a new Board and a Supervisory Board) into account when ruling on admissibility on appeal. This suggests foundations such as TPC have some time between filing the claim and the first hearing on admissibility to fulfil the various governance requirements.
Governance and influence of the funder
The judgment also provides clarity on the use of litigation funding and adjusting the governance structure of the respective foundation. As mentioned, TPC made several adjustments to its governance structure to meet the admissibility requirements laid down in the WAMCA. Oracle and Salesforce contested this, arguing that TPC lacked these structures when the appeal was filed and that the sole director at the time was appointed by the funder, suggesting TPC could not independently file the appeal. However, the Court of Appeal sided with TPC, noting that at the time of the appeal hearing, the Management and Supervisory Board were in place and sufficiently independent. Had they disagreed with the Board Member who had decided to bring the appeal, they could have withdrawn the appeal. The Court of Appeal also found no evidence that the funder influenced TPC’s policy decisions. The Court of Appeal also notes that under the WAMCA, engaging a litigation funder is allowed and often necessary due to high costs. The Court of Appeal further rejected the defendants’ request for disclosure of the litigation funding agreement.
Clarifications with respect to claims seeking non-material damages
The most important aspect of the judgment, however, arguably lies in its treatment of the collective nature of the damages suffered by internet users from Oracle and Salesforce’s alleged data breaches.
According to TPC’s claim, every internet user whose personal data was processed by Oracle and Salesforce had suffered non-material damages in the amount of EUR 500 per user. Oracle and Salesforce disputed the extent of the damages, arguing that it is implausible for all individuals to have suffered the same non-material harm since this is highly personal. They claimed this issue should affect TPC’s admissibility.
The Court of Appeal recognized the ambiguity surrounding the damages, pointing out that both Dutch law and the GDPR require that actual damages are suffered for compensation to be granted. In addition, neither Dutch law nor the GDPR allows for punitive damages. The Court of Appeal also agreed with Oracle and Salesforce that there may be large differences between individual internet users and that some users covered by the claim may not have suffered any damages at all.
However, the Court of Appeal held that these issues should not hinder TPC’s admissibility. What mattered was that the same breach of standards lay at the heart of TPC’s collective claim. Moreover, at a later stage in the proceedings the victims could be placed into different categories, accounting for differences between them. Finally, it is more efficient to deal with damages on a collective basis, and this is why the WAMCA was adopted in the first place. The Court also clarified that the severity of the damages should be discussed during the substantive debate on damages.
It is interesting to put this appeal court ruling next to the TikTok judgement of the (lower) Amsterdam District Court in 2023. There, the District Court found that any claim for non-material damages by users of TikTok depended so much on the individual situation of each user that there is no bundleable, sufficiently similar, claim. The argument that the damage could be assumed given the nature and seriousness of the privacy violation, was not followed by the District Court in TikTok. The District Court stated that the adverse effects must be obvious, which in the case of TikTok did not apply. As a result, the Amsterdam District Court deemed claims for non-material damages to be inadmissible in that case.
Although TPC v Oracle and Salesforce is a different case based on different facts, the Court of Appeal appears to depart from the TikTok line of reasoning. Reading between the lines, the Court of Appeal appears to be saying that where there is an arguable case that a large group of victims have been affected by the same breach of standards and have suffered harm, the case should move to a substantive assessment rather than get stuck in the admissibility phase (provided, of course, it meets the other admissibility requirements).
Constituency requirements
The judgment also contains helpful practical guidance on the issue of proving that the entity bringing the claim is “representative”. The Court of Appeal confirms that the WAMCA does not require the constituency to contain a minimum number of people for the claim vehicle to meet the representativeness requirement. The Court clarified that it is sufficient that a constituency exists i.e. that a non-negligible number of persons belonging to that narrowly defined group support the collective action. The fact that several organizations (such as the Dutch Consumers Association (consumentenbond)) support the collective action is also relevant, because it shows that there is awareness and support for the claim.
Additionally, foundations have a lot of freedom in using a mechanism to show support for the claim. For example, TPC used a website where it was possible to support the claim through a “like” feature. The Court of Appeal considered the number of “likes” to be a relevant way of demonstrating that a fair number of individuals supported the collective action.
Finally, the Court clarified that organizing your constituency does not necessitate members leaving their e-mail addresses on the website. An obligation to register has the characteristics of an opt-in system, which goes further than what the law requires. Therefore, the threshold is lower for foundations to create a mechanism to ensure participation in an opt-out claim.
Significance of the judgement
This judgment represents a significant development in the realm of collective claims because it clarifies several essential issues surrounding admissibility and representativeness for the foundation representing its constituency. It has essentially lowered the threshold as to what needs to be demonstrated when it comes to the extent of the damages suffered by the constituency at an early stage of the proceedings.
As Lord Briggs of the UK Supreme Court held in Merricks, a central purpose of the power to award aggregate damages in collective proceedings is to avoid the need for individual assessment of loss. The Amsterdam Court of Appeal appears to subscribe to the same view, holding that differences between individual victims should not mean a collective claim on their behalf should be inadmissible. Instead, there are mechanisms to deal with them such as categorisation.
All of this signals a desire of the Court of Appeal to see these cases proceed to a proper assessment on the merits as opposed to such collective claims being held back and delayed through procedural issues. Like the Merricks judgment, this significantly reduces the scope for procedural challenges at the admissibility stage of WAMCA cases. Oracle and Salesforce will feel there are many important arguments they can still make in the next phases of this case, and TPC will face some difficult questions. However, the case now proceeds and that in itself sets an important precedent.
Stijn Huijts is a Partner at Geradin Partners in Brussels and Amsterdam. Philine Wassenaar is an associate at Geradin Partners in Amsterdam.