Views
First strike in a Dutch TikTok class action on privacy violation: court accepts international jurisdiction
Written by Eduardo Silva de Freitas (Erasmus University Rotterdam) & Xandra Kramer (Erasmus University Rotterdam/Utrecht University), members of the Vici project Affordable Access to Justice, financed by the Dutch Research Council (NWO), www.euciviljustice.eu.
Introduction
On 9 November 2022 the District Court Amsterdam accepted international jurisdiction in an interim judgment in a collective action brought against TikTok (DC Amsterdam, 9 November 2022, ECLI:NL:RBAMS:2022:6488; in Dutch). The claim is brought by three Dutch-based representative organisations; the Foundation for Market Information Research (Stichting Onderzoek Marktinformatie, SOMI), the Foundation Take Back Your Privacy (TBYP) and the Stichting Massaschade en Consument (Foundation on Mass Damage and Consumers). It concerns a collective action brought under the Dutch collective action act (WAMCA) for the infringement of privacy rights of children (all foundations) and adults and children (Foundation on Mass Damage and Consumers). In total, seven TikTok entities are sued, located in Ireland, the United Kingdom, California, Singapore, the Cayman Islands and China. The claims are for the court to order that an effective system is implemented for age registration, parental permission and control, and measures to ensure that commercial communication can be identified and that TikTok complies with the Code of Conduct of the Dutch Media Act and the GDPR.
After an overview of the application of the WAMCA, which has been introduced in a different context on this blog earlier, we will discuss how the Court assessed the question of international jurisdiction.
The class action under the Dutch WAMCA
Following case law of the Dutch Supreme Court in the 1980s concerning legal standing of representative organisations, the possibility to start a collective action was laid down in Article 3:305a of the Dutch Civil Code (DCC) in 1994. However, this was limited to declaratory and injunctive relief. Redress for compensation in mass damage cases was only introduced in 2005 with the enactment of the Collective Settlement of Mass Claims Act (Wet collectieve afwikkeling massaschade, WCAM). This collective settlement scheme enables parties to jointly request the Amsterdam Court of Appeal to declare a settlement agreement binding on an opt-out basis. The legislative gap remained as a collective action for compensation was not possible and such mass settlement agreement relies on the willingness of an allegedly liable party to settle.
This gap was closed when in 2019, after a lengthy legislative process, the Act on Redress of Mass Damages in a Collective Action (Wet afwikkeling massaschade in collectieve actie, WAMCA) was adopted. The WAMCA entered into force on 1 January 2020 and applies to mass events that occurred on or after 15 November 2016. The WAMCA expanded the collective action contained in Article 3:305a DCC to include actions for compensation of damage (Tillema, 2022; Tzankova and Kramer, 2021). While the WAMCA Act generally operates on an opt-out basis for beneficiaries represented by the representative organisation(s), there are exemptions, including for parties domiciled or habitually resident outside the Netherlands. In addition, the standing and admissibility requirements are relatively strict, and also include a scope rule requiring a close connection to the Netherlands. Collective actions are registered in a central register (the WAMCA register) and from the time of registration a three-months period starts to run (to be extended to maximum six months), enabling other claim organisations to bring a claim, as only one representative action can be brought for the same event(s). If no settlement is reached, an exclusive representative will be appointed by the court. Since its applicability as of 1 January 2020, 61 collective actions have been registered out of which 8 cases have been concluded to date; only a very few cases have been successful so far. These collective actions involve different cases, including consumer cases, privacy violations, environmental and human rights cases, intellectual property rights, and cases against the government. Over one-third of the cases are cross-border cases and thus raise questions of international jurisdiction and the applicable law.
As mentioned above, in the TikTok case eventually three Dutch representative foundations initiated a collective action against, in total, seven TikTok entities, including parent company Bytedance Ltd. (in the first action, the claim is only brought against the Irish entity; in the other two actions, respectively, six and seven entities are defendants). These are TikTok Technology Limited (Ireland), TikTok Information Technology Limited (UK), TikTok Inc. (California), TikTok PTE Limited (Singapore), Bytedance Ltd. (Cayman Islands), Beijng Bytedance Technology Co. Ltd. (China) and TikTok Ltd. (also Cayman Islands). The claim is, in essence, that these entities are responsible for the violation of fundamental rights of children and adults. The way in which the personal data of TikTok users is processed and shared with third parties violates the GDPR as well as the Dutch Telecommunications Act and Media Act. It is also claimed that TikTok’s terms and conditions violate the Unfair Contract Terms Directive (UCTD – 93/13/EEC) and the relevant provisions of the Dutch Civil Code.
International jurisdiction of the Amsterdam District Court
The first stage of the proceedings, leading up to this interim judgment, deals with the international jurisdiction of the District Court of Amsterdam, as the TikTok entities challenge its international jurisdiction. TikTok requested the Court to refer preliminary questions to the CJEU but the Court refused this request, stating that the questions on (a) how the GDPR and Brussels I-bis Regulation regimes interact and (b) the applicability of Article 79(2) GDPR were deemed resolved.
Relevant jurisdiction rules
Considering the domicile of the defendant(s) and the alleged violation of the GDPR, both EU and Dutch domestic jurisdiction rules come into the picture. TikTok alleges that the Dutch courts do not have jurisdiction over this case under Article 79(2) GDPR. Moreover, TikTok alleges that, since Article 79(2) GDPR is a lex specialis in relation to the Brussels I-bis Regulation, the latter cannot be applied to override the jurisdictional rules set out in the GDPR. The three representative organisations argue that the Dutch courts have jurisdiction under both EU private international law rules and the Dutch Code of Civil Procedure (DCCP). Before delving into how the District Court of Amsterdam construed the interaction between the legislations concerned, we will describe the applicable rules on international jurisdiction for privacy violations. The alleged violations occurred, or the claims relate to violations occurring, after 25 May 2018, that is, after the entry into force of the GDPR. TikTok Ireland is a data controller subject to the GDPR. Under Article 79(2) GDPR the “data subjects” (those whose rights are protected by the GDPR) shall bring an action for the violation of their rights in either the courts of the Member State in which the data controller or processor is established or of the Member State in which the data subject has its habitual residence. Furthermore, Article 80(1) GDPR provides for the possibility of data subjects to mandate a representative body which has been properly constituted under the law of that Member State, has statutory objectives which are in the public interest, and is active in the field of the protection of data subjects’ rights and freedoms to file actions on their behalf under Article 79 GDPR.
The case also deals with non-GDPR-related claims, which triggers the application of the Brussels I-bis Regulation, at least as far as the entities domiciled in the EU are concerned. Article 7(1)(a) Brussels I-bis states that, for contractual matters, jurisdiction is vested in the Member State in which the contract is to be performed. More importantly for this case, with regards to torts, Article 7(2) provides jurisdiction for the courts of the place where the harmful event occurred or may occur. Finally, in relation to the TikTok entities that are not domiciled in the EU, the international jurisdiction rules of the Dutch Code of Civil Procedure (Articles 1-14 DCCP) apply. This is the case regarding both GDPR and non-GDPR-related claims. These Dutch rules are largely based on those of the Brussels I-bis Regulation and also include a rule on multiple defendants in Article 7 DCCP.
The claims against TikTok Ireland
The Amsterdam District Court starts its reasoning by addressing whether it has jurisdiction over TikTok Technology Limited, domiciled in Ireland, the entity that is sued by all three representative organisations. The Court states that Article 80(1) GDPR does not distinguish between substantive and procedural rights in granting the possibility for data subjects to mandate a representative body to file actions on their behalf under Article 79 GDPR. Therefore, actions brought under Article 80(1) GDPR can rely on the jurisdictional rule set out in Article 79(2) GDPR which allows for the bringing of actions before the courts of the Member State in which the data subject has its habitual residence. The Court further reasons that the word ‘choice’ enshrined in Recital 145 GDPR, when mentioning actions for redress, allows for the interpretation that it is up to the data subject to decide where she prefers to file her claim. In the case at hand, since the data subjects concerned reside in the Netherlands, they can mandate a representative body to file claims before the Dutch courts.
As to the non-GDPR-related claims and GDPR violations that also qualify as tortious conduct, the District Court considered first whether the case concerned contractual matters, to decide whether Article 7(1) or Article 7(2) Brussels I-bis Regulation applies. For this purpose, the District Court relied on the rule established by the CJEU in Wikingerhof v. Booking.com (Case C-59/19, ECLI:EU:C:2020:95), according to which a claim comes under Article 7(2) when contractual terms as such and their interpretation are not at stake, but rather the application of legal rules triggered by the commercial practices concerned – or, in other words, contractual “interpretation being necessary, at most, in order to establish that those practices actually occur”. Given that, in this case, the question is whether TikTok’s terms and conditions are abusive under both the UCTD and the DCC, the claim was deemed to fall under Article 7(2) Brussels I-bis Regulation.
Next, the District Court assesses whether the criteria for establishing jurisdiction under Article 7(2) are met. For this purpose it refers to the CJEU ruling in eDate Advertising and Others (Case C-509/09, ECLI:EU:C:2011:685). In this case the CJEU ruled that, when it comes to “publication of information on the internet” that triggers an “adverse effect on personality rights”, the habitual residence of the victim being his centre of interests can be regarded as the place in which the damage occurred. The District Court rightfully ruled that since the rights of TikTok users that have their habitual residence in the Netherlands had been violated through online means, the Netherlands can be regarded as the place in which the damage occurred.
The Court confronts TikTok’s argument that, since Article 79(2) GDPR is a lex specialis in relation to the Brussels I-bis Regulation, the latter cannot be applied to override the jurisdictional rules set out in the GDPR. As per the Court, the rules on conflict of jurisdiction established by the Brussels I-bis Regulation are general in nature and, as such, cannot be derogated from other than by explicit rules. Hence, the Court interprets Recital 147 GDPR – which states that the application of the Brussels I-bis Regulation should be without prejudice to the application of the GDPR – as being unable to strip away the applicability of the Brussels I-bis Regulation. In the Court’s understanding, Recital 147 GDPR points to the complementarity of the GDPR in relation to the Brussels I-bis Regulation, and both regimes coexist without hierarchy. Therefore, according to the Court, the GDPR is not a lex specialis in relation to the Brussels I-bis Regulation. Furthermore, the Court notes that, under Article 67 Brussels I-bis Regulation, its regime is without prejudice to specific jurisdictional rules contained in EU legislation on specific matters. While the relationship between the jurisdiction rules of the GDPR and the Brussels I-bis Regulation is not wholly undisputed, in the present case the provisions do not contradict each other, while at the same time in this case also non-GDPR issues are at stake.
The claims against non-EU based TikTok entities
Having established international jurisdiction in the case against TikTok Ireland, the Amsterdam District Court rules on its international jurisdiction in relation to the other TikTok entities sued by two of the foundations. As no EU rules or international convention applies, the Dutch jurisdiction rules laid down in Articles 1-14 DCCP apply. Article 7(1) DCCP contains a rule for multiple defendants and connected claims similar to that in Article 8(1) Brussels I-bis. The Court considers that both legal and factual aspects are closely intertwined in this case. The claims concern several different services, not only the processing of data, and all defendants are involved in the provision of these services. The claims are therefore so closely connected that it is expedient that they are dealt with in the same proceedings.
Outlook
TikTok attempted to appeal this interim judgment on international jurisdiction. Under Article 337(2) DCCP, it is at the court’s discretion to grant leave to appeal interim decisions when the appeal is not filed against the final judgment at the same time. In this case, the Court did not find sufficient reasons to allow for such appeal. The case will now proceed on other preliminary matters, including the admissibility of the claim under the WAMCA, and (if admissible) the appointment of the exclusive representative. For this purpose, at the end of its judgment the Court orders parties to provide security as to the financing of the case, which requires submitting to the Court a finance agreement with the third-party financer. After that, assuming that no settlement will be reached, the case will proceed on the merits. It may well be that either of the parties will appeal the final judgment, and that on that occasion TikTok will raise the jurisdictional question again.
To be continued.
GEDIP’s Reccommendation on the Proposal for a Directive on Corporate Sustainability Due Diligence
Written by Hans van Loon, former Secretary General of the HCCH and Honorary Professor of the University of Edinburgh Law School
As reported in this blog before (see CSDD and PIL: Some Remarks on the Directive Proposal), the European Commission on 23 February 2022 adopted a proposal for a Directive on corporate sustainability due diligence.
Earlier, at its annual meeting in 2021, the European Group for Private International Law (GEDIP) had adopted a Recommendation to the EU Commission concerning the PIL aspects of corporate due diligence and corporate accountability, and this blog reported on this Recommendation too, see GEDIP Recommendation to the European Commission on the private international law aspects of the future EU instrument on corporate due diligence and accountability.
While some of the recommendations proposed by GEDIP last year are reflected in the Draft Directive, the Draft fails to follow up on several crucial recommendations concerning judicial jurisdiction and applicable law. This will detract from its effectiveness.
In particular:
- The Proposal, while extending to third country companies lacks a provision on judicial jurisdiction in respect of such companies;
- The Proposal, while extending a company’s liability to the activities of its subsidiaries and to value chain co-operations carried out by entities “with which the company has a well-established business relationship”, lacks a provision dealing with the limitation of the provision on co-defendants in the Brussels I bis Regulation (Article 8(1)) to those domiciled in the EU;
- The Proposal lacks a provision allowing a victim of a violation of human rights to also invoke, similar to a victim of environmental damage under Article 7 of Regulation 864/2007 (Rome II), the law of the country in which the event giving rise to the damage occurred, and does not prevent companies from invoking a less strict rule of safety or conduct within the meaning of Article 17 of Rome II;
- The provision of the Proposal on the mandatory nature of the provisions of national law transposing the Directive (Article 22 (5)) is insufficient because (i) the words “in cases where the law applicable to actions for damages to this effect is not that of a Member State” are redundant and (ii) allthese provisions of national law transposing the Directive should apply irrespective of the law applicable to companies, contractual obligations or non-contractual obligations.
GEDIP therefore, on the occasion of its meeting in Oslo, 9-11 September 2022 adopted a Recommendation concerning the Proposal for a directive of 23 February 2022 on Corporate Sustainability Due Diligence, following up on its Recommendation to the Commission of 8 October 2021. The text of the Recommendation can be found here.
[This post is cross-posted at the EAPIL blog]
Chinese Case Law Collection Adds to the CISG’s Jurisconsultorium: Reflections on the United Nations Convention on Contracts for the International Sale of Goods and its Domestic Implementations
The United Nations Convention on Contracts for the International Sale of Goods (‘CISG’), currently adopted by 95 States, is a treaty intended to harmonise the laws governing cross-border goods trade: and thereby promote trade itself. So much is made clear in its Preamble:
The States Parties to this Convention, …
Being of the opinion that the adoption of uniform rules which govern contracts for the international sale of goods and take into account the different social, economic and legal systems would contribute to the removal of legal barriers in international trade and promote the development of international trade,
Have agreed as follows: …
Art. 7(1) CISG’s instruction for interpreters to have regard ‘to its international character and to the need to promote uniformity in its application and the observance of good faith in international trade’ establishes a requirement of autonomous interpretation. This, in turn, facilitates the CISG’s global jurisconsultorium: whereby courts, arbitrators, lawyers, academics, and other interested stakeholders can influence and receive influence in relation to the CISG’s uniform interpretation. A recent publication edited by Peng Guo, Haicong Zuo and Shu Zhang, titled Selected Chinese Cases on the UN Sales Convention (CISG) Vol 1, makes an important contribution to this interpretative framework: presenting abstracts and commentaries addressing 48 Chinese CISG cases spanning 1993 to 2005, that may previously have been less accessible to wider international audiences.
A review of this case law collection discloses an interesting phenomenon affecting the CISG’s Chinese application: at least, until very recently. Pursuant to Art. 142(2) General Principles of the Civil Law (which was effective in the People’s Republic of China until repealed as of 1 January 2021):
[I]f any international treaty concluded or acceded to by the People’s Republic of China contains provisions differing from those in the civil laws of the People’s Republic of China, the provisions of the international treaty shall apply, unless the provisions are ones on which the People’s Republic of China has announced reservations.
Numerous contributions to Guo, Zuo and Zhang’s volume – including by Wang, Guo and Zhang; Luo; Luo again; Wang; and Xu and Li – observe that some Chinese courts have interpreted this provision to require the CISG’s application only where it is inconsistent with non-harmonised Chinese law. Whilst this approach to the CISG’s application is noteworthy for its inconsistency with international understandings of the treaty, it is arguably more noteworthy for highlighting that national law itself is often ‘where the relationship between the convention and national law is regulated’.[1] Scholarship has given much attention to the success (or otherwise) of Art. 7(1) CISG in securing the treaty’s autonomous interpretation. However, machinery provisions giving the CISG local effect in any given legal system (themselves being matters of ‘local legislative judgment’) have an apparently-underappreciated role to play, too.
Wang’s contribution quotes Han as writing that the Chinese inconsistency concept’s effective implementation of a reverse burden of proof in establishing the CISG’s application is a situation that ‘I am afraid … is unique in the world’. On the contrary, and not unlike China’s former Art. 142(2) General Principles of the Civil Law, Australia’s CISG implementing Acts still ostensibly frame the treaty’s local application in terms of inconsistency. The Sale of Goods (Vienna Convention) Act 1986 (NSW) s 6 is representative of provisions found across the Australian state and territory jurisdictions: ‘[t]he provisions of the Convention prevail over any other law in force in New South Wales to the extent of any inconsistency’. Case law from Victoria and from Western Australia has read those jurisdictions’ equivalent inconsistency provisions as implying the CISG’s piecemeal application, only where particular provisions are inconsistent with local law. Looking even further afield, Australia’s own use of the inconsistency device is far from unique. Singaporean and Canadian legislation make use of the inconsistency concept, as does Hong Kong’s recently-promulgated CISG Ordinance. In the latter case, the statutory interpretation risks associated with the adoption of an inconsistency provision were drawn to the Hong Kong Department of Justice’s attention. However, Australia’s statutory model prevailed, perhaps in part because it has previously been put forward as a model for Commonwealth jurisdictions looking to implement the CISG.
At the risk of being slightly controversial, at least some scholarship addressing the failings of national CISG interpretations may have been asking the wrong question: or at least, missing an important additional question. Instead of asking why any given court has failed to apply and respect Art. 7(1) CISG’s interpretative directive, we might instead (or also) usefully ask whether that given State’s CISG implementation legislation has been drafted so as to invite the local law comparisons that have then been made. Some responsibility for problematic CISG interpretations might lie with the legislature, in addition to the judiciary.
In Australia, the Playcorp decision – Victoria’s inconsistency case referred to above – has been taken by subsequent cases in both the Federal Court and in the Full Federal Court of Australia as authority for the proposition that Art. 35 CISG’s conformity requirements equate to the implied terms contained in the non-harmonised Goods Act 1958 (Vic) s 19. The Federal Court’s first-instance decision was itself then cited in New South Wales for that same proposition: leading to a problematic CISG interpretation that is now entrenched under multiple layers of precedent. Whilst the equation being made here is rightly criticised in itself, it has Australia’s inconsistency provisions – in addition to our courts’ failures to apply Art. 7(1) CISG – resting at its core.
Guo, Zuo and Zhang’s Selected Chinese Cases on the UN Sales Convention (CISG) Vol 1 thereby makes a valuable contribution to the Convention’s jurisconsultorium: first, by virtue of its very existence, but secondly, by its additional disclosure of China’s former inconsistency struggles to the wider scholarly community.
[1] Bruno Zeller, ‘The CISG in Australasia: An Overview’ in Franco Ferrari (ed), Quo Vadis CISG? Celebrating the 25th Anniversary of the United Nations Convention on Contracts for the International Sale of Goods (Bruylant, 2005) 293, 299.
* Senior Lecturer, Department of Business Law and Taxation, Monash Business School
Twitter: @LawGuyPI
International Trade and International Commercial Law research group: @MonashITICL
Disclosure: The author is a confirmed contributor to the forthcoming Selected Chinese Cases on the UN Sales Convention (CISG) Vol 3.
News
Out Now: P. Perlingieri, G. Perlingieri, G. Zarra (eds), Istituzioni di diritto privato internazionale e europeo
Pietro Perlingieri, Giovanni Perlingieri, and Giovanni Zarra have edited a new book on Istituzioni di diritto privato internazionale e europeo.
The blurb reads as follows:
The book follows from the need for an interdisciplinary perspective to the regulation of civil relations, which also takes into account the direct and horizontal effects that international and European Union law may have on such relationships. The need for certainty in international trade requires, while respecting national identities, a uniform framework beyond the domestic level. Uniformity, however, cannot always be achieved by means of the same substantive rules for cross-border relationships; for this reason, the book devotes particular attention to rules of private international law of supranational origin. The work overcomes the ‘barriers’ between legal disciplines through a study of the different ways in which civil relationships are regulated by international and European Union law, including private international law.
Further information can be found on the publisher’s website.
Nagy, Csongor István, Private International Law: A Hungarian Perspective (June 1, 2024)
Nagy, Csongor István, Private International Law: A Hungarian Perspective (June 1, 2024). Law in Eastern Europe, Volume: 71, ISBN: 978-90-04-69456-9 (e-book), ISBN: 978-90-04-69083-7, 2024, Available at SSRN: https://ssrn.com/abstract=4840867
Just published: Second Report on the application of the General Data Protection Regulation (GDPR)
The Second Report on the application of the General Data Protection Regulation (GDPR) has just been published, click here. For the full report, click here: Second Report GDPR.