Rotterdam District Court, in an interlocutory ruling on Amazon v. Stichting Data Bescherming Nederland, has decided to refer preliminary questions to the Court of Justice of the European Union (CJEU). The case was brought by SDBN, which acts on behalf of about 5 million Amazon account holders in the Netherlands. SDBN claims that Amazon processes personal data of its account holders in violation of the General Data Protection Regulation (AVG). The outcome of this case has major implications for mass claims under the AVG in the Netherlands but certainly also in the rest of Europe.
The heart of the dispute revolves around whether SDBN is admissible to bring this class action under the WAMCA and Article 80(2) AVG. SDBN based its claims in part on violations of the AVG. Both the AVG and the WAMCA impose admissibility requirements on interest groups seeking to bring collective actions. Under Article 80 AVG, an interest group must, among other things, be lawfully constituted, have no profit motive, serve public interest and be active in the field of data protection. Article 3:305a BW additionally requires sufficient representativeness considering the constituency and the scope of interests represented, which is not explicitly included in the AVG.
Amazon argues that SDBN does not meet all of the admissibility requirements under the WAMCA and the AVG. In particular, Amazon disputes SDBN's representativeness, as it presumably represents only 0.26% of the relevant target audience. It further argues that SDBN is not active in the field of data protection, is guided by a for-profit litigation financier, does not sufficiently represent similar interests, and does not have effective mechanisms for participation by its constituency. Amazon also argues that because SDBN is acting without an order, it cannot seek damages.
SDBN refutes these objections and primarily argues that a specific order is not required to bring its claims.
The court formulated the following preliminary questions for the CJEU:
In addition to the requirements of Article 80(1) AVG, is it permissible for member states to impose further admissibility requirements on interest groups seeking to bring claims on behalf of data subjects on the basis of the AVG?
Are the admissibility requirements in the WAMCA permissible in light of Article 80(1) AVG when advocates on behalf of data subjects wish to bring a class action for damages against a controller or processor for violations of the AVG?
Does Article 80(2) AVG preclude a national regulation, such as the WAMCA, that allows an interest group to bring a class action for damages on behalf of data subjects without explicit orders from data subjects at that time?
In this context, is it relevant that the WAMCA allows litigants to refuse to use advocacy in writing at two points: after the court appoints the advocate and after the parties conclude a settlement agreement?
The court has given SDBN the opportunity to amend its claims, in particular to drop the claims for damages. If SDBN chooses to do so, it is possible that the light regime of Article 3:305a(6) of the Civil Code will apply, which may obviate the need for preliminary questions. The court has referred the case to the December 11, 2024 roll for SDBN to take a deed. Amazon will then have the opportunity to respond.
The CJEU's ruling in this case will be of great importance for future class actions under the AVG in the Netherlands. The answers to the preliminary questions will clarify the scope of the WAMCA and the possibilities for interest groups to act on behalf of aggrieved parties in data privacy cases.
