In force since January 2020, a new Dutch class actions law (the WAMCA(1)) empowers foundations and associations to claim damages on behalf of injured parties on an opt-out basis. In its 2020 writ of summons, The Privacy Collective (TPC) foundation asserted that Oracle and Salesforce violated the privacy rights of approximately ten million Dutch Internet users and claimed damages on their behalf.

TPC alleged that Salesforce and Oracle unlawfully processed personal data of Dutch Internet users in violation of the General Data Protection Regulation (GDPR) and Article 11.7a of the Dutch Telecommunication Act (the “cookie rules”). TPC argued that defendants were not permitted, through their Data Management Platform service, to collect data through cookies, combine it with other additional information and then subsequently create individual profiles of users. The profiles were used to offer personalised online advertisements and were shared with ad tech providers in a process known as Real Time ­Bidding (RTB).