Rb. Amsterdam - C/13/702849 / HA ZA 21-526, C/13/706680 / HA ZA 21-789 and C/13/706842 / HA ZA 21-794: Difference between revisions
From GDPRhub
No edit summary |
No edit summary |
||
| (2 intermediate revisions by one other user not shown) | |||
| Line 88: | Line 88: | ||
The foundations claimed that the controller violated the fundamental rights of children (all foundations) and adults (SMC). In particular, the way that the controller processed personal data violated the GDPR, the Telecommunications Act and the Media Act. In addition, the controller violated provisions of mandatory consumer and media law. The foundations stated that the controller shared personal data of users with third parties without a legal basis. | The foundations claimed that the controller violated the fundamental rights of children (all foundations) and adults (SMC). In particular, the way that the controller processed personal data violated the GDPR, the Telecommunications Act and the Media Act. In addition, the controller violated provisions of mandatory consumer and media law. The foundations stated that the controller shared personal data of users with third parties without a legal basis. | ||
The foundations each requested the Court to designate it as the exclusive representative within the meaning of | The foundations each requested the Court to designate it as the exclusive representative within the meaning of [https://wetten.overheid.nl/jci1.3:c:BWBR0001827&boek=Derde&titeldeel=14&artikel=1018&z=2022-10-01&g=2022-10-01 Article 1018(1) of the Code of Civil Procedure] (''Wetboek van Burgerlijke Rechtsvordering-'' ''Rv'') for the data subjects as described in their summons. This concerned minors for SOMI and STBYP and minors and adults for SMC. | ||
Regarding the jurisdiction, the foundations stated that the Dutch Court had jurisdiction under [[Article 79 GDPR#2|Article 79(2)]] to [[Article 80 GDPR|80 GDPR]] | Regarding the jurisdiction, the foundations stated that the Dutch Court had jurisdiction under [[Article 79 GDPR#2|Article 79(2)]] to [[Article 80 GDPR|80 GDPR]], as well as under [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2012:351:0001:0032:en:PDF the Brussels I Regulation] (Brussels I) and [https://wetten.overheid.nl/jci1.3:c:BWBR0001827&z=2021-01-01&g=2021-01-01 Code of Civil Procedure]. | ||
==== Submissions of the controller ==== | ==== Submissions of the controller ==== | ||
The controller requested that the Court declared itself incompetent to take note of any claims that | The controller requested that the Court declared itself incompetent to take note of any claims that fell within the scope of the GDPR. According to the controller, the right to bring proceedings before the Court of data subjects' habitual residence was a 'privilege of jurisdiction' that only applied to individual data subjects. As the data subjects were represented by the foundations, jurisdiction could in this case not be derived from their place of residence. Since none of the controller's entities were established in the Netherlands, the Dutch Court did not have jurisdiction pursuant to [[Article 79 GDPR]]. The controller further argued that jurisdiction rules under the GDPR - as a ''lex specialis'' to Brussels I - were exclusive in nature and took precedence over those under the Brussels I. Therefore, no jurisdiction could be derived from Brussels I either. | ||
In addition, the controller requested that preliminary questions be referred to the CJEU on (i) how the rules on jurisdiction under the GDPR and the Brussels I relate to each other and (ii) whether a representative can rely on the ground of jurisdiction following from Article 79(2) GDPR. | In addition, the controller requested that preliminary questions be referred to the CJEU on (i) how the rules on jurisdiction under the GDPR and the Brussels I relate to each other and (ii) whether a representative can rely on the ground of jurisdiction following from [[Article 79 GDPR#2|Article 79(2) GDPR]]. | ||
It further requested that these proceedings be stayed pending a final decision of the Irish Data Protection Commissioner (DPC) in two investigations into TikTok, and pending the preliminary ruling of the CJEU in case [[CJEU - C-132/21 - | It further requested that these proceedings be stayed pending a final decision of the Irish Data Protection Commissioner (DPC) in two investigations into TikTok, and pending the preliminary ruling of the CJEU in case [[CJEU - C-132/21 - Nemzeti Adatvédelmi és Információszabadság Hatóság|C-132/21]]. | ||
=== Holding === | === Holding === | ||
The Court noted that the underlying legal questions were (i) whether the Court has jurisdiction under the GDPR and (ii) how the jurisdiction regime of the GDPR compares with that of | The Court noted that the underlying legal questions were (i) whether the Court has jurisdiction under the GDPR and (ii) how the jurisdiction regime of the GDPR compares with that of Brussels I. | ||
==== TikTok Ireland: jurisdiction under the GDPR ==== | ==== TikTok Ireland: jurisdiction under the GDPR ==== | ||
The Court stated that most of the foundations' claims related to alleged breaches of the GDPR concerning data subject's residing in the Netherlands. The Court held that the foundations conducted the litigation on the basis of Article 3:305a of the Dutch Civil Code<ref>This provision is a part of the implementation of the Class Actions Act. See Comment for more information.</ref> | The Court stated that most of the foundations' claims related to alleged breaches of the GDPR, concerning data subject's residing in the Netherlands. The Court held that the foundations conducted the litigation on the basis of [https://wetten.overheid.nl/jci1.3:c:BWBR0005291&boek=3&titeldeel=11&artikel=305a&z=2017-09-01&g=2017-09-01 Article 3:305a of the Dutch Civil Code] (''Burgerlijk wetboek - BW'')<ref>This provision is a part of the implementation of the Class Actions Act. See Comment for more information.</ref>. Thus, they qualified as representatives within the meaning of [[Article 80 GDPR]]. Subsequently, jurisdiction could be based on [[Article 79 GDPR#2|Article 79(2) GDPR]] regarding the foundations' claims against the controller's establishment in Ireland. | ||
The Court added that the controller's argument | The Court added that the controller's argument that the right to bring proceedings before the Court of the data subject's place of residence ([[Article 79 GDPR#2|Article 79(2) GDPR]]) was to be regarded as a 'privilege of jurisdiction' for only the data subject itself did not stand up. Contrary to what the controller argued, the ground for jurisdiction was not an exception to a main rule. Neither from [[Article 79 GDPR#2|Article 79(2)]], nor from Recital 145 GDPR, did it follow that there was any ranking in the grounds of jurisdiction. | ||
==== TikTok Ireland: Jurisdiction under Brussels I ==== | ==== TikTok Ireland: Jurisdiction under Brussels I ==== | ||
Next, the Court assessed whether it had jurisdiction under | Next, the Court assessed whether it had jurisdiction under Brussels I to the extent that these violations also qualify as unlawful acts and for the other non-GDPR related claims. The Court first looked at the general rule pursuant to Article 4(1) Brussels I: those established in the territory of a Member State shall be sued in the courts of that Member State. As TikTok Ireland was established in Ireland, jurisdiction could not be assumed under the general rule. | ||
Second, the Court assessed whether jurisdiction could be based on Article 7 Brussels I. More precise, whether the foundations' claims were based on a contractual obligation pursuant to Article 7(1) or a tort pursuant to Article 7(2) Brussels I. The court assumed, for the purpose of assessing its jurisdiction at this stage, that the legal questions to be answered in a later stage of the proceedings would not require an interpretation of the agreements between the controller and the data subjects. Therefore, it held that Article 7(2) Brussels I was applicable. The Court noted that Article 7(2) Brussels I assigns jurisdiction based on the 'Handlungsort' (the place where the event causing the damage occurred) and the 'Erfolgsort' (the place where the damage occurred). It found that the data subjects had the centre of their interests in the Netherlands, meaning that the damage occurred in the Netherlands (the Erfolgsort). Therefore, the Court held that it could derive jurisdiction from Article 7(2) Brussels I concerning the claims against TikTok Ireland. | Second, the Court assessed whether jurisdiction could be based on Article 7 Brussels I. More precise, whether the foundations' claims were based on a ''contractual obligation'' pursuant to Article 7(1) or a ''tort'' pursuant to Article 7(2) Brussels I. The court assumed, for the purpose of assessing its jurisdiction at this stage, that the legal questions to be answered in a later stage of the proceedings would not require an interpretation of the agreements between the controller and the data subjects. Therefore, it held that Article 7(2) Brussels I was applicable. The Court noted that Article 7(2) Brussels I assigns jurisdiction based on the 'Handlungsort' (the place where the event causing the damage occurred) and the 'Erfolgsort' (the place where the damage occurred). It found that the data subjects had the centre of their interests in the Netherlands, meaning that the damage occurred in the Netherlands (the Erfolgsort). Therefore, the Court held that it could derive jurisdiction from Article 7(2) Brussels I concerning the claims against TikTok Ireland. | ||
Regarding the controller's argument that the GPDR takes precedence over the Brussels I, the Court stated that the GDPR complements the general rules of jurisdiction set out in Brussels I, these regimes coexist. There was no indication from the text of the GDPR, as well as the recitals that Article 79(2) GDPR would be an exclusive rule, setting aside the rules of Brussels I. The Court did note that pursuant to Article 67(1) Brussels I, the latter shall not affect the application of provisions governing jurisdiction in particular matters that are contained in acts of the Union. The provisions of Brussels I should thus not prejudice the application of Article 79(2) GDPR. However, this just meant that where both Brussels I and the GDPR apply, Brussels I cannot take away any competence designated by the GDPR. But the GDPR would not be a ''lex specialis'' to Brussels I. | Regarding the controller's argument that the GPDR takes precedence over the Brussels I, the Court stated that the GDPR complements the general rules of jurisdiction set out in Brussels I, these regimes coexist. There was no indication from the text of the GDPR, as well as the recitals that Article 79(2) GDPR would be an exclusive rule, setting aside the rules of Brussels I. The Court did note that pursuant to Article 67(1) Brussels I, the latter shall not affect the application of provisions governing jurisdiction in particular matters that are contained in acts of the Union. The provisions of Brussels I should thus not prejudice the application of Article 79(2) GDPR. However, this just meant that where both Brussels I and the GDPR apply, Brussels I cannot take away any competence designated by the GDPR. But the GDPR would not be a ''lex specialis'' to Brussels I. | ||
==== The other TikTok entities: Jurisdiction under the Code of Civil Procedure ==== | ==== The other TikTok entities: Jurisdiction under the Code of Civil Procedure ==== | ||
The assessment of the jurisdiction regarding the controller's other entities is only relevant for the claims from STBYP and SMC. The Court noted that since no treaty on the jurisdiction between the Netherlands and the countries in which the controller's other entities were established, the matter must be assessed by national law: the | The assessment of the jurisdiction regarding the controller's other entities is only relevant for the claims from STBYP and SMC. The Court noted that since no treaty on the jurisdiction between the Netherlands and the countries in which the controller's other entities were established, the matter must be assessed by national law: the Code of Civil Procedure (Rv). It followed that pursuant to [https://wetten.overheid.nl/jci1.3:c:BWBR0001827&boek=Eerste&titeldeel=Eerste&afdeling=Eerste&artikel=7&z=2021-01-01&g=2021-01-01 Article 7(1) Rv], the Dutch Court had jurisdiction if (i) the cases were so intertwined that they justify a joint hearing for reasons of efficiency, and (ii) it already had jurisdiction for one of the defendants (in this case: TikTok Ireland). | ||
The Court found the bases of the claims brought by STBYP and SMC against all the controller's entities were the same. This fact was not concretely disputed by the controller. In addition, while the controller argued that TikTok Ireland was the sole processor of personal data, it did not dispute that its other entities were also involved in the provision of its service. In that regard, the Court found that the claims related not only to the obligations of the controller or processor, but also to other aspects of the provision of its service. Therefore, the Court held that given the complexity of facts and the legal intertwining of the claims, it was justified for reasons of efficiency that the claims would be dealt with together. | The Court found the bases of the claims brought by STBYP and SMC against all the controller's entities were the same. This fact was not concretely disputed by the controller. In addition, while the controller argued that TikTok Ireland was the sole processor of personal data, it did not dispute that its other entities were also involved in the provision of its service. In that regard, the Court found that the claims related not only to the obligations of the controller or processor, but also to other aspects of the provision of its service. Therefore, the Court held that given the complexity of facts and the legal intertwining of the claims, it was justified for reasons of efficiency that the claims would be dealt with together. | ||
Latest revision as of 12:26, 28 June 2023
| Rb. Amsterdam - C/13/702849 / HA ZA 21-526, C/13/706680 / HA ZA 21-789 and C/13/706842 / HA ZA 21-794 | |
|---|---|
 | |
| Court: | Rb. Amsterdam (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 79 GDPR Article 80 GDPR Article 18 Regulation (EU) 1215/2012 Article 67 Regulation (EU) 1215/2012 Article 7 Regulation (EU) 1215/2012 artikel 3:305a BW (Dutch Civil Code) |
| Decided: | 09.11.2022 |
| Published: | 09.11.2022 |
| Parties: | Stichting Onderzoek Marktinformatie (SOMI) Stichting Take Back Your Privacy (STBYP) Stichting Massaschade & Consument (SMC) TikTok Technology Limited, TikTok Information Technologies UK Limited, TikTok inc., TikTok pte. Limited, Bytedance Ltd., Beijng Bytedance Technology co. Ltd., TikTok Ltd. |
| National Case Number/Name: | C/13/702849 / HA ZA 21-526, C/13/706680 / HA ZA 21-789 and C/13/706842 / HA ZA 21-794 |
| European Case Law Identifier: | ECLI:NL:RBAMS:2022:6488 |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Dutch |
| Original Source: | rechtspraak.nl (in Dutch) |
| Initial Contributor: | Jette |
The District Court of Amsterdam held that it was competent, pursuant to the GDPR, Brussels I, as well as national law, to assess the claims of three collective redress foundations that argue that TikTok unlawfully violates the privacy of its users.
English Summary
Facts
Stichting onderzoek Marktinformatie (SOMI), Stichting Take Back Your Privacy (STBYP) and Stichting Massaschade & Consument (SMC) are three Dutch Foundations focused on class actions. The Foundations all separately sued the TikTok group (the controller). TikTok is a social media platform where users can post, view, like and share videos. SOMI summoned TikTok Ireland, while STBYP and SMC started class actions against multiple TikTok entities. As the cases were similar, they were considered together in this preliminary ruling.
Submissions of the foundations
The foundations claimed that the controller violated the fundamental rights of children (all foundations) and adults (SMC). In particular, the way that the controller processed personal data violated the GDPR, the Telecommunications Act and the Media Act. In addition, the controller violated provisions of mandatory consumer and media law. The foundations stated that the controller shared personal data of users with third parties without a legal basis.
The foundations each requested the Court to designate it as the exclusive representative within the meaning of Article 1018(1) of the Code of Civil Procedure (Wetboek van Burgerlijke Rechtsvordering- Rv) for the data subjects as described in their summons. This concerned minors for SOMI and STBYP and minors and adults for SMC.
Regarding the jurisdiction, the foundations stated that the Dutch Court had jurisdiction under Article 79(2) to 80 GDPR, as well as under the Brussels I Regulation (Brussels I) and Code of Civil Procedure.
Submissions of the controller
The controller requested that the Court declared itself incompetent to take note of any claims that fell within the scope of the GDPR. According to the controller, the right to bring proceedings before the Court of data subjects' habitual residence was a 'privilege of jurisdiction' that only applied to individual data subjects. As the data subjects were represented by the foundations, jurisdiction could in this case not be derived from their place of residence. Since none of the controller's entities were established in the Netherlands, the Dutch Court did not have jurisdiction pursuant to Article 79 GDPR. The controller further argued that jurisdiction rules under the GDPR - as a lex specialis to Brussels I - were exclusive in nature and took precedence over those under the Brussels I. Therefore, no jurisdiction could be derived from Brussels I either.
In addition, the controller requested that preliminary questions be referred to the CJEU on (i) how the rules on jurisdiction under the GDPR and the Brussels I relate to each other and (ii) whether a representative can rely on the ground of jurisdiction following from Article 79(2) GDPR.
It further requested that these proceedings be stayed pending a final decision of the Irish Data Protection Commissioner (DPC) in two investigations into TikTok, and pending the preliminary ruling of the CJEU in case C-132/21.
Holding
The Court noted that the underlying legal questions were (i) whether the Court has jurisdiction under the GDPR and (ii) how the jurisdiction regime of the GDPR compares with that of Brussels I.
TikTok Ireland: jurisdiction under the GDPR
The Court stated that most of the foundations' claims related to alleged breaches of the GDPR, concerning data subject's residing in the Netherlands. The Court held that the foundations conducted the litigation on the basis of Article 3:305a of the Dutch Civil Code (Burgerlijk wetboek - BW)[1]. Thus, they qualified as representatives within the meaning of Article 80 GDPR. Subsequently, jurisdiction could be based on Article 79(2) GDPR regarding the foundations' claims against the controller's establishment in Ireland.
The Court added that the controller's argument that the right to bring proceedings before the Court of the data subject's place of residence (Article 79(2) GDPR) was to be regarded as a 'privilege of jurisdiction' for only the data subject itself did not stand up. Contrary to what the controller argued, the ground for jurisdiction was not an exception to a main rule. Neither from Article 79(2), nor from Recital 145 GDPR, did it follow that there was any ranking in the grounds of jurisdiction.
TikTok Ireland: Jurisdiction under Brussels I
Next, the Court assessed whether it had jurisdiction under Brussels I to the extent that these violations also qualify as unlawful acts and for the other non-GDPR related claims. The Court first looked at the general rule pursuant to Article 4(1) Brussels I: those established in the territory of a Member State shall be sued in the courts of that Member State. As TikTok Ireland was established in Ireland, jurisdiction could not be assumed under the general rule.
Second, the Court assessed whether jurisdiction could be based on Article 7 Brussels I. More precise, whether the foundations' claims were based on a contractual obligation pursuant to Article 7(1) or a tort pursuant to Article 7(2) Brussels I. The court assumed, for the purpose of assessing its jurisdiction at this stage, that the legal questions to be answered in a later stage of the proceedings would not require an interpretation of the agreements between the controller and the data subjects. Therefore, it held that Article 7(2) Brussels I was applicable. The Court noted that Article 7(2) Brussels I assigns jurisdiction based on the 'Handlungsort' (the place where the event causing the damage occurred) and the 'Erfolgsort' (the place where the damage occurred). It found that the data subjects had the centre of their interests in the Netherlands, meaning that the damage occurred in the Netherlands (the Erfolgsort). Therefore, the Court held that it could derive jurisdiction from Article 7(2) Brussels I concerning the claims against TikTok Ireland.
Regarding the controller's argument that the GPDR takes precedence over the Brussels I, the Court stated that the GDPR complements the general rules of jurisdiction set out in Brussels I, these regimes coexist. There was no indication from the text of the GDPR, as well as the recitals that Article 79(2) GDPR would be an exclusive rule, setting aside the rules of Brussels I. The Court did note that pursuant to Article 67(1) Brussels I, the latter shall not affect the application of provisions governing jurisdiction in particular matters that are contained in acts of the Union. The provisions of Brussels I should thus not prejudice the application of Article 79(2) GDPR. However, this just meant that where both Brussels I and the GDPR apply, Brussels I cannot take away any competence designated by the GDPR. But the GDPR would not be a lex specialis to Brussels I.
The other TikTok entities: Jurisdiction under the Code of Civil Procedure
The assessment of the jurisdiction regarding the controller's other entities is only relevant for the claims from STBYP and SMC. The Court noted that since no treaty on the jurisdiction between the Netherlands and the countries in which the controller's other entities were established, the matter must be assessed by national law: the Code of Civil Procedure (Rv). It followed that pursuant to Article 7(1) Rv, the Dutch Court had jurisdiction if (i) the cases were so intertwined that they justify a joint hearing for reasons of efficiency, and (ii) it already had jurisdiction for one of the defendants (in this case: TikTok Ireland).
The Court found the bases of the claims brought by STBYP and SMC against all the controller's entities were the same. This fact was not concretely disputed by the controller. In addition, while the controller argued that TikTok Ireland was the sole processor of personal data, it did not dispute that its other entities were also involved in the provision of its service. In that regard, the Court found that the claims related not only to the obligations of the controller or processor, but also to other aspects of the provision of its service. Therefore, the Court held that given the complexity of facts and the legal intertwining of the claims, it was justified for reasons of efficiency that the claims would be dealt with together.
Following the above, the Court held that it had jurisdiction over the foundations' claims.
Prejudicial questions and suspension
The Court found no reason to refer the controller's questions to the CJEU for a preliminary ruling. Regarding the suspension of the proceedings, the Court held that in view of the current stage of the proceedings, the requirements of due process oppose a suspension. It stated that there was no risk of contradictory or - where the answers to the questions referred for a preliminary ruling are concerned - incompatible decisions being taken. However, the procedure would be unreasonably delayed if it were stayed.
Comment
On 1 January 2020, the ‘Settling of Large-scale Losses or Damages (Class Actions) Act’[2] or ‘WAMCA’ for short entered into force in the Netherlands. This Act amended the Dutch Civil Code and Code of Civil Procedure. As a result, the settlement of mass damages in collective actions in the Netherlands became possible.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
verdict
COURT OF AMSTERDAM
Private Law Department
case number / roll number: C/13/702849 / HA ZA 21-526, C/13/706680 / HA ZA 21-789 and C/13/706842 / HA ZA 21-794
Judgment of November 9, 2022
in Case C/13/702849 v HA ZA 21-526 of
the foundation
FOUNDATION RESEARCH MARKET INFORMATION,
located in Badhoevedorp,
plaintiff,
lawyer mr. D.M. Linders in Amsterdam,
against
the legal entity under Irish law
TIKTOK TECHNOLOGY LIMITED,
based in Dublin (Ireland),
defendant,
lawyer mr. G.H. Potty-wide in Amsterdam,
in case 706680 / HA ZA 21-789 of
the foundation
FOUNDATION TAKE BACK YOUR PRIVACY,
Based in Amsterdam,
plaintiff on the basis of article 1018d DCCP,
lawyer mr. D.F. Berkhout in Amsterdam,
against
1. the company under Irish law
TIKTOK TECHNOLOGY LIMITED,
based in Dublin (Ireland),
defendant,
lawyer mr. G.H. Potty-wide in Amsterdam,
2. the company incorporated under United Kingdom law
TIKTOK INFORMATION TECHNOLOGIES UK LIMITED,
based in London (United Kingdom),
defendant,
lawyer mr. G.H. Potty-wide in Amsterdam,
3. the company under foreign law
TIKTOK INC.,
based in Culver City, California (United States of America),
defendant,
lawyer mr. G.H. Potty-wide in Amsterdam,
4. the company incorporated under the law of the Republic of Singapore
TIKTOK PTE. LIMITED,
located in Singapore (Republic of Singapore),
defendant,
lawyer mr. G.H. Potty-wide in Amsterdam,
5. the company incorporated under the laws of the Cayman Islands
BYTEDANCE LTD.,
located at West Bay Road, Grand Cayman (Cayman Islands),
defendant,
lawyer mr. G.H. Potty-wide in Amsterdam,
6. the company incorporated under the laws of the People's Republic of China
BEIJING BYTEDANCE TECHNOLOGY CO. LTD.,
located in Beijing (China),
defendant,
not published.
and
in case 706842 / HA ZA 21-794 of
the foundation
MASS DAMAGE & CONSUMER FOUNDATION,
located in Oegstgeest, the Netherlands,
plaintiff on the basis of article 1018d DCCP,
lawyer mr. C.A. Alberdingk Thijm in Amsterdam,
against
1. the company under Irish law
TIKTOK TECHNOLOGY LIMITED,
based in Dublin (Ireland),
defendant,
lawyer mr. G.H. Potty-wide in Amsterdam,
2. the company incorporated under United Kingdom law
TIKTOK INFORMATION TECHNOLOGIES UK LIMITED,
based in London (United Kingdom),
defendant,
lawyer mr. G.H. Potty-wide in Amsterdam,
3. the company under foreign law
TIKTOK INC.,
based in Culver City, California (United States of America),
defendant,
lawyer mr. G.H. Potty-wide in Amsterdam,
4. the company incorporated under the law of the Republic of Singapore
TIKTOK PTE. LIMITED,
located in Singapore (Republic of Singapore),
defendant,
lawyer mr. G.H. Potty-wide in Amsterdam,
5. the company incorporated under the laws of the Cayman Islands
BYTEDANCE LTD.,
located at West Bay Road, Grand Cayman (Cayman Islands),
defendant,
lawyer mr. G.H. Potty-wide in Amsterdam,
6. the company incorporated under the laws of the People's Republic of China
BEIJING BYTEDANCE TECHNOLOGY CO. LTD.,
located in Beijing (China),
defendant,
not published,
7. the company incorporated under the laws of the Cayman Islands
TIKTOK LTD.,
located at West Bay Road, Grand Cayman (Cayman Islands),
defendant,
lawyer mr. G.H. Potty-wide in Amsterdam.
Plaintiffs are hereinafter referred to as: SOMI, STBYP and SMC and together also as the foundations.
Defendants are referred to as: TikTok Ireland, TikTok UK, TikTok Inc, TikTok Pte, Bytedance, Beijing Bytedance and TikTok Ltd. The appearing defendants are collectively referred to as TikTok et al. and the appearing defendants and the non-appearing defendant together as the TikTok defendants.
Insofar as the parties have referred to "TikTok" without further specification, it is assumed that the claimants have meant all TikTok defendants - insofar as summoned by each of them - and that TikTok et al. only meant TikTok et al.
1 The procedure
1.1.
The course of the procedure is apparent from:
-
the role decisions of July 28, 2021, September 8, 2021, October 13, 2021 and February 23, 2022 and the documents referred to therein,
-
the interlocutory judgment of June 22, 2022, restored by judgment of July 27, 2022, stipulating an oral hearing,
-
the separate conclusions of SOMI, STBYP and SMC of 1 June 2022 on the jurisdiction of the Dutch court and the request for arrest, with exhibits,
-
the official report of the oral hearing of 10 October 2022 with the documents referred to therein and
-
a letter dated November 1, 2022 from mr. Potjewijd on behalf of TikTok et al. about the official report.
1.2.
Finally, verdict has been determined.
2 Introduction
2.1.
Defendants are entities within the Tiktok group. Bytedance is the parent company. In November 2017, Bytedance acquired the musical.ly application and merged it with TikTok, which makes it possible to post, view, like and share short homemade videos online (hereinafter: the TikTok Service). The TikTok Service is available through the app for mobile devices and through the website www.tiktok.com.
2.2.
SOMI was founded on May 31, 2016. After an amendment of the Articles of Association on May 31, 2021, its articles of association state, among other things:
2.1 The Foundation aims to:
(a) representing the interests of natural persons, in particular consumers and minors, who use online services, where at any time there is a violation of the rights of those natural persons, including but not limited to violations of fundamental rights, such as the right not to be discriminated against and the right to privacy and protection of personal data, as well as violations of consumer rights and laws and regulations protecting minors;”
2.3.
STBYP was incorporated on February 24, 2021. STBYP's Articles of Association, insofar as relevant, read as follows:
“ PURPOSE OF ARTICLE 2
1. The foundation aims to represent the interests of natural persons who use the internet and/or use other products and/or services that process personal data, so that these users may at any time be faced with a violation of their right to privacy, including but not limited to their right to the protection of personal data, or may be related to a violation of their consumer rights, or violation of other fundamental or legal rights, all in the broad sense of the the word (which persons are hereinafter also referred to as: the "Duppers"). The foundation also aims to do everything that is related to or may be conducive to the foregoing, all in the broadest sense of the word (…)”
2.4.
SMC was founded on March 15, 2021. The articles of association of SMC read, among other things, as follows:
“Article 3.
1. As an independent organization, the Foundation aims to represent the interests of consumers in general and of Participants of the Foundation in particular in the Netherlands - and insofar as possible and necessary outside of it - with any political or ideological organization. .
2. In order to protect the interests of consumers, the Foundation itself or one or more legal entities to be established by the Foundation may, among other things - but not exclusively - initiate legal or other claims as referred to in:
a. Section 3:305a(1) of the Dutch Civil Code;
b. article 6:240 Dutch Civil Code; or
c. Directive (EU) 2020/1828 of the European Parliament and of the Council of twenty-five November two thousand and twenty on representative actions for the protection of the collective interests of consumers and repealing Directive 2009/22/EC (…)”
2.5.
In a letter dated September 8, 2020, SOMI held TikTok UK responsible for, among other things, various violations of the privacy rights of children in the Netherlands. TikTok Ireland responded to this in a letter dated October 9, 2020. SOMI invited TikTok Ireland and TikTok Pte on May 7, 2021 to enter into consultations. TikTok Ireland informed SOMI on 20 May 2021 that it rejected the statements and claims made by SOMI, but was open to consultation. After further correspondence, SOMI has summoned TikTok Ireland on June 1, 2021.
2.6.
On June 23, 2021, STBYP held, among other things, the defendant TikTok parties liable for unlawful acts and invited them to enter into consultations. A response was received on 8 July 2021 and a discussion between the parties took place on 8 August 2021. The consultations did not lead to a solution. After that, the parties continued to communicate with each other. STBYP issued the subpoena on August 30, 2021.
2.7.
In a letter dated July 28, 2021, SMC held Bytedance, TikTok Ltd., TikTok Ireland, TikTok UK and TikTok Inc liable for the damage suffered by the SMC supporters due to the violation of (fundamental) rights and unlawful acts. She has also invited the TikTok parties that have been contacted to enter into consultations. On August 11, 2021, TikTok Ireland sent a response on behalf of the TikTok parties contacted by SMC. After further correspondence between the parties, SMC issued the summons on September 3, 2021.
3 What this case is about
3.1.
With effect from 1 January 2020, the Act on the Settlement of Mass Damages in Collective Action or the WAMCA (Act of 20 March 2019, Stb. 130, amending the Civil Code (BW) and the Code of Civil Procedure (Rv)) has come into effect. in order to enable the settlement of mass damages in a class action. In addition, Articles 3:305a to 3:305d of the Dutch Civil Code have been amended and title 14A ('Procedure of justice in cases concerning a class action and collective claim settlement') has been inserted into the Rv.
3.2.
The foundations have filed claims as referred to in Section 3:305a of the Dutch Civil Code. SOMI has summoned TikTok Ireland by subpoena dated June 1, 2021. STBYP and SMC then filed a class action against multiple TikTok entities for the same events.
3.3.
Very briefly, the foundations base the claims that each of the TikTok defendants is responsible for the way in which the fundamental rights of children (all foundations) and adults (SMC) have been and are being violated. The way in which the TikTok defendant(s) use/make use of personal data constitutes an infringement of the AVG1 and furthermore of provisions of the Telecommunications Act and the Media Act. In addition, the TikTok defendant(s) violates provisions of mandatory consumer and media law. The TikTok defendants are acting unlawfully. Without a lawful basis, the personal data of the users of the TikTok Service is processed and shared with third parties. The foundations demand, among other things, various declaratory decisions, that the court order various measures to stop the violations, that the (general) conditions that apply to the agreements with the users of the TikTok Service are annulled and that the TikTok service is cancelled. the defendant(s) is/are ordered to pay compensation for the material and immaterial damage of the supporters.
3.4.
The foundations each demand that the court designate it as the exclusive representative within the meaning of Article 1018e paragraph 1 DCCP and to determine that it represents the interests of the Narrowly Described Groups it has described in their summons. SOMI and STBYP's claims relate to minors and SMC's claims to minors and adults who have used the TikTok Service after May 25, 2018.
3.5.
The claims of the foundations are reproduced verbatim in the appendix attached to this judgment.
3.6.
A procedural order was established by a decision on the role of 23 February 2022. At present (the so-called first phase) it concerns the jurisdiction of the Dutch court. There are no incidents.
TikTok et al. and afterwards the foundations have each taken a conclusion or deeds on this subject. TikTok et al. submitted a request for preliminary rulings to the Court of Justice of the European Union (CJEU) and furthermore, pending other ongoing proceedings (investigations by the Irish regulator into (privacy) infringements by TikTok and the answer of preliminary questions by the CJEU in another case) to stay this procedure.
4 The dispute in the first phase
4.1.
TikTok et al. concludes, in summary, its conclusion referred to under 3.6 as follows:
That the court, by judgment to be declared provisionally enforceable:
I. declares itself incompetent to take cognizance of all claims that fall within the scope of the GDPR;
II. in the alternative, with regard to the claim under I, the present proceedings continue with regard to every part of the claims in respect of which the court does not now declare that it has no jurisdiction;
III. in any event declares that the court has no jurisdiction with respect to claims relating to contract and
IV. in any case, orders the foundations to pay the legal costs and subsequent costs, plus statutory interest.
4.2.
The foundations each state in their deeds referred to under 3.6 that, summarized below, the court has jurisdiction to take cognizance of all claims and they conclude that the arrest requests of TikTok et al. STBYP requests that TikTok et al. be ordered to pay the costs of the proceedings and the subsequent costs, plus statutory interest. SMC requests that TikTok c.s. be ordered to pay the legal costs, plus statutory interest.
5 The assessment
Jurisdiction – introduction
5.1.
The claims of the foundations relate to the period after May 25, 2018. That is after the entry into force of the GDPR. The parties agree that (the majority of) the claims are based on the GDPR. What divides them, among other things, is whether the court has jurisdiction under the GDPR and how the jurisdiction regime of the GDPR compares to that in the Brussels I bis Regulation2.
5.2.
Recital 145 of the GDPR states:
'For proceedings against a controller or processor, the complainant should be able to choose to bring the matter before the courts in the Member State where the controller or processor has an establishment, or to do so in the Member State where the data subject resides, unless the controller is a public authority of a Member State acting under public authority.'
5.3.
Recital 147 of the GDPR states:
'Where this Regulation provides for specific rules of jurisdiction, in particular with regard to proceedings seeking a remedy, including compensation, against a controller or processor, general rules of jurisdiction, such as those of Regulation (EU) No 1215/2012 of the European Parliament and the Council, without prejudice to the application of those specific rules.'
5.4.
Articles 79 and 80 of the GDPR are also relevant for the assessment, which include:
"Article 79"
Right to an effective remedy against a controller or a processor
(…)
2. Proceedings against a controller or processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Such proceedings may also be brought before the courts of the Member State where the data subject habitually resides, unless the controller or processor is a public authority of a Member State acting in the exercise of public authority.'
Article 80
‘ Representation of stakeholders
1. The data subject shall have the right to a non-profit making body, organization or association duly constituted under the law of a Member State, whose statutory objectives serve the public interest and which is active in the field of protection of the data subject's rights and freedoms in relation to the protection of his/her personal data, to make the complaint on his behalf, to exercise on his behalf the rights referred to in Articles 77, 78 and 79 and to carry out on his behalf the in Article 82 to exercise the said right to compensation, if provided for under Member State law.
2. Member States may provide that a body, organization or association referred to in paragraph 1 of this Article has the right to lodge a complaint in that Member State with the competent supervisory authority in accordance with Article 77, independently of the mandate of a data subject, and exercise the rights referred to in Articles 78 and 79 if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.
(…)'
5.5.
Article 7 preamble and under 1 a) of the Brussels Ia Regulation provides that a person domiciled in the territory of a Member State in another Member State may be sued in respect of a contractual obligation in the court of the place where the obligation underlying the claim has been or is to be performed. In matters relating to tort, delict or quasi-delict, a person domiciled in the territory of a Member State in another Member State may be sued in the courts for the place where the harmful event occurred or may occur (Article 7 introductory words and under 2 of the Brussels Ia Regulation). Article 67(1) of the Brussels Ia Regulation states, inter alia, that this Regulation is without prejudice to the application of provisions governing jurisdiction in particular matters and which have been or will be included in Union acts.
5.6.
Also relevant in this case are the provisions of the first section (“Jurisdiction of the Dutch court”) of the first title of the first book of Rv. When interpreting these provisions, in principle, a link must be sought with the case law of the CJEU on the (predecessors of the) Brussels I bis Regulation.3
5.7.
TikTok et al. argue that the Dutch court does not have jurisdiction under the second paragraph of Article 79 of the GDPR. None of the defendants is domiciled in the Netherlands and jurisdiction cannot be derived from the domicile of the alleged supporters of the foundations as “person involved” within the meaning of that provision. Since the majority of the claims of the foundations are GDPR-related, the Dutch court cannot therefore take cognizance of the dispute. The jurisdiction rules of the GDPR have an exclusive character and take precedence over the rules from the Brussels I bis Regulation. As a lex specialis with regard to the Brussels I bis Regulation, the GDPR provides for its own rules of jurisdiction. In the event that the GDPR does not provide a basis for jurisdiction, jurisdiction cannot still be based on the general jurisdiction rules in the Brussels I bis Regulation.
5.8.
The foundations argue that the Dutch court has jurisdiction on the basis of Article 79 paragraph 2 of the GDPR as well as on the basis of the general rules of jurisdiction in the Brussels I bis Regulation and Rv. It follows from Article 80 of the GDPR that representatives of interests can rely on Article 79, paragraph 2 of the GDPR. Finally, the GDPR is not an exclusive regulation that sets aside the provisions of the Brussels Ia Regulation.
Jurisdiction TikTok Ireland
5.9.
First, jurisdiction will be assessed in respect of TikTok Ireland. TikTok Ireland has been sued by each of the foundations.
5.10.
The majority of the foundations' claims relate to alleged breaches of the GDPR. The Dutch court has jurisdiction over those claims. The basic principle here is that it is established that TikTok Ireland is in any case the controller with regard to the processing of personal data that is the subject of these proceedings.
5.11.
The first sentence of Article 79(2) of the GDPR states that proceedings against a controller or processor shall be brought before the courts of the Member State where the controller or processor has an establishment. In these proceedings, none of the defendants is established in the Netherlands. The position of the foundations that the Dutch court has jurisdiction on this ground, because TikTok has (also) had an office in the Netherlands since February 2022, does not require discussion. This is because the jurisdiction against TikTok Ireland can already be based on the second sentence of Article 79 paragraph 2 GDPR (see below).
5.12.
Article 79, paragraph 2, second sentence of the GDPR includes the option of bringing proceedings against the controller in the courts of the Member State where the data subject (i.e. the person whose data is processed) habitually resides. This procedure concerns data subjects residing in the Netherlands. The foundations have argued that, now that they represent the interests of those involved, the jurisdiction of the Dutch court has thus been given. TikTok et al. argue, on the other hand, that the foundations cannot rely on the residence of the data subjects for the purpose of jurisdiction. TikTok c.s. is not followed in this. Article 80 of the GDPR provides for the possibility for a representative to exercise the rights of data subjects without making a distinction between procedural and substantive rights. Also in view of the explicit reference in Article 80 GDPR (both paragraphs 1 and 2) to Article 79 GDPR, it is concluded that the foundations can rely on the habitual residence of the data subjects as representatives of the interests. TikTok et al.'s argument that the right to bring proceedings before the courts of the data subject's habitual residence can be regarded as a 'privilege of jurisdiction' exclusively for the individual data subject does not hold. Contrary to what TikTok et al. argue, that ground for jurisdiction is not an exception to a main rule. This is not apparent from the wording of Article 79(2) of the GDPR, nor from recital 145 to the GDPR, which provides that the complainant can 'choose' to bring the case before the courts in the Member State where the controller or processor has an establishment or to do so in the Member State where the person concerned resides. Any ranking in grounds of jurisdiction does not follow from this. Finally, the comparison made by TikTok et al. with Article 18 of the Brussels I bis Regulation and the judgments of the CJEU in the cases Shearson Lehman Hutton, [party] and Schrems4 does not hold. The foundations do not litigate on the basis of an order or power of attorney. The foundations conduct the process on the basis of Article 3:305a of the Dutch Civil Code and can therefore be regarded as representatives of interests within the meaning of Article 80 of the GDPR.
5.13.
SMC describes the Narrowly Described Group, among other things, as 'the natural persons who lived or stayed in the Netherlands at a time or during a period after the entry into force of the GDPR'. It is possible that members of that group were no longer living in the Netherlands at the time SMC issued its summons. The court will not now discuss the question of whether it is competent for the claims against those persons on the basis of what has been considered under 5.12. This will be taken into account in the decision to be taken regarding the determination of the Closely Defined Group.
5.14.
The conclusion is that the Dutch court has jurisdiction with regard to the claims against TikTok Ireland, as far as the GDPR-related claims are concerned.
5.15.
The claims of the foundations can mostly be qualified as violations of provisions of the GDPR. Insofar as these GDPR violations also qualify as unlawful acts and with regard to other non-GDPR-related claims, it must be assessed on the basis of the Brussels I bis Regulation whether the Dutch court has jurisdiction. The dispute falls within the scope of the Brussels Ia Regulation, both materially, formally and temporally.
5.16.
Because TikTok Ireland is established in Ireland, jurisdiction cannot be assumed under the main rule of the Brussels Ia Regulation (those domiciled in a Member State are sued in the courts of that Member State, Article 4(1)). . For the question whether the jurisdiction can be based on Article 7 paragraph 1 and/or Article 7 paragraph 2 of the Brussels Ia Regulation, it is important to determine whether any claim of the foundations is based on a contractual obligation in the sense of Article 7 paragraph 1 of the Regulation. According to settled case law of the CJEU, the concept of 'contracts in tort, delict or quasi-delict' within the meaning of Article 7(2) of the Brussels Ia Regulation includes any legal action aimed at challenging the liability of a defendant and which is not related to a contractual obligation within the meaning of Article 7(1)(a) of the Brussels Ia Regulation.5 A claim relates to contractual obligations when the interpretation of the agreement is necessary to establish whether the alleged conduct is lawful or unlawful is.6 This is particularly the case with a claim based on the terms of a contract or on the applicable legal rules.7 When the claimant invokes the rules of tort, i.e. a breach of a legal obligation , and it is not necessary to examine the content of the contract concluded with the defendant in order to determine whether the is lawful or unlawful, the ground for the claim, on the other hand, arises from tort within the meaning of Article 7, paragraph 2 of the Brussels I bis Regulation, since that obligation rests on the defendant independently of the contract.8 The court decides on behalf of from the assessment of its jurisdiction before this stage, it is assumed that the legal questions to be answered in the third stage do not require an explanation of the agreements between the TikTok defendants and the users of the TikTok Service. Insofar as the foundations demand a declaratory judgment that certain general terms and conditions used by the TikTok defendants are unreasonably onerous, it can be assumed on the basis of the Wikingerhof judgment that those claims are based on tort. As in the Wikingerhof judgment, this concerns a situation in which it must be assessed whether the fact that an agreement is concluded in a certain form constitutes abuse. In the case of Wikingerhof, this concerns a dominant position, in this case the possible abuse resulting from the fact that unfair general terms and conditions are included in the contract without negotiation. The legal question that is central to this claim is whether the TikTok entity has abused, in an agreement with a consumer as user of general terms and conditions, by means of unfair terms within the meaning of Directive 93/13 and - if Dutch law is applicable is - to include article 6:233 under a of the Dutch Civil Code in the agreement. That is a question that requires an abstract assessment of that clause within the meaning of Article 7 of Directive 93/13, whereby it is not necessary to interpret the concrete contracts concluded between the TikTok defendants and certain consumers.
5.17.
It is settled case law of the CJEU that Article 7 paragraph 2 of the Brussels I bis Regulation creates jurisdiction on the basis of the 'Handlungsort' (the place where the event causing the damage occurred) and the 'Erfolgsort' (the place where the damage occurred). This rule of special jurisdiction must be interpreted autonomously and strictly.9 It is based on the existence of a particularly close link between the action and the courts of the place where the harmful event occurred or may occur, so that, from the point of view of good administration of justice and a useful process organization is justified that these courts have jurisdiction. The Netherlands can be regarded as the place where the damage occurred ('Erfolgsort'). Important in this regard is the judgment of the CJEU in the eDate-[party] case, in which it was ruled that the 'Erfolgsort' in the event of an alleged violation of personality rights by content posted on the internet is located in the user's country where it is located. the center of its interests. 10 The situation in which (privacy) rights are violated via an online service can be equated with this. The users of the TikTok Service whose interests the foundations claim to represent have the center of their interests in the Netherlands (and insofar as this has changed in the meantime, what has been considered under 5.13) applies. This means that the damage has occurred in the Netherlands and the Dutch court can also derive jurisdiction with regard to TikTok Ireland from Article 7 paragraph 2 of the Brussels I bis Regulation.
5.18.
Contrary to what TikTok et al. has argued, the court also derives its jurisdiction with regard to GDPR violations that also qualify as unlawful acts (see number 5.15) from the Brussels I bis Regulation. The GDPR supplements the general jurisdiction rules as laid down in the Brussels I bis Regulation and these arrangements coexist. In view of the general character and, in principle, the broad substantive scope of the jurisdiction regime laid down in the Brussels Ia Regulation, it can only be assumed that the EU legislature intended to adopt a jurisdiction regime deviating from that regulation, not additionally but applying exclusively, if that is sufficiently clearly expressed in the relevant regulation. It cannot be inferred from the text of the GDPR and the preamble that the jurisdiction regulation of Article 79(2) of the GDPR is an exclusive regulation that sets aside the rules of the Brussels Ia Regulation. The preamble to the GDPR under 147 merely states that the general jurisdiction rules of the Brussels Ia Regulation may not prejudice the application of the specific jurisdiction rules included in the GDPR. This underlines the complementary nature of the GDPR compared to the Brussels Ia Regulation.
Furthermore, Article 67(1) of the Brussels Ia Regulation provides that that Regulation is without prejudice to the application of provisions governing jurisdiction in particular matters and which have been or will be incorporated into Union acts. The provisions of the Brussels I bis Regulation may thus not affect the application of specific jurisdiction regulations such as those resulting from the GDPR. This simply means that in a situation such as this, where both the Brussels Ia Regulation and the GDPR apply, the Brussels Ia Regulation cannot deprive a power designated by the GDPR. The jurisdiction rules of the GDPR are therefore not a lex specialis compared to those in the Brussels Ia Regulation.
Jurisdiction of other defendants - Related claims
5.19.
Between the Netherlands and the countries in which the other defendants involved by STBYP and SMC in these proceedings are established (the TikTok defendants with the exception of TikTok Ireland), no treaty applies with regard to the jurisdiction of the Dutch courts. The international jurisdiction of the Dutch court with regard to those defendants must be assessed on the basis of Rv. STBYP and SMC invoke (among other things) article 7 paragraph 1 Rv. It states that if, in cases to be initiated by summons, the Dutch court has jurisdiction over one of the defendants, it also has jurisdiction over other defendants involved in the same proceedings, provided that such coherence exists that reasons of efficiency justify joint treatment. It must therefore be assessed whether there is a sufficiently close connection in that sense between the claims against TikTok Ireland and the claims against the other defendants involved in the proceedings by STBYP and SMC.
5.20.
Although TikTok et al. argue that TikTok Ireland can be regarded as a processor of personal data and the other TikTok defendants appearing not, TikTok et al. has not disputed that the other TikTok defendants appearing are also involved in the provision of the TikTok Service; the defendant Beijing Bytedance who did not appear has not put forward a defense on this point, so that this can also be assumed in respect of her. TikTok et al. has also not specifically contested the connection alleged between the claims against the various defendants. The claims relate not only to the obligations of the controller or processor, but also to other aspects of the provision of the TikTok Service. In view of the complex of facts and the legal interdependence of the claims, it is justified for reasons of efficiency that the claims against the various defendants are heard jointly. The grounds of the claims brought by STBYP and SMC against all TikTok defendants are the same. It always concerns the same acts and the claims of both foundations are directed against all TikTok defendants - insofar as they have been summoned - without any distinction being made. Concomitant treatment is therefore recommended. The question of which defendants can be regarded as the processors of personal data or as those responsible for them is a question that becomes relevant in the substantive assessment of the dispute. This phase of the procedure only concerns the preliminary question with regard to jurisdiction and no further investigation on that point is necessary. The conclusion is that on the basis of article 7 paragraph 1 DCCP the Dutch court also has jurisdiction over TikTok UK, TikTok Inc, TikTok Pte, Bytedance, TikTok Ltd and with due observance of the provisions of article 139 et seq. Rv also with regard to Beijing. Bytedance.
Jurisdiction
5.21.
All this means that the Dutch court has jurisdiction to hear the claims of the foundations. The court is of the opinion that it also has relative jurisdiction with regard to those claims.
Preliminary questions
5.22.
In view of the foregoing, there is no reason to ask the CJEU questions for a preliminary ruling about (i) how the jurisdictional regulations from the GDPR and the Brussels I bis Regulation relate to each other and about (ii) whether a representative can invoke the jurisdictional ground. from the second sentence of Article 79 (2) GDPR. TikTok et al.'s request to that effect is therefore rejected.
Arrest
5.23.
TikTok et al. also request that these proceedings be adjourned pending a final decision by the Irish Data Protection Commissioner (DPC) in two investigations into TikTok and pending the preliminary ruling of the CJEU in case C-132/21. The DPC's investigations focus on GDPR compliance with regard to data protection by design and default, compliance with transparency obligations and the transfer of personal data to third countries. The case pending before the CJEU concerns two parallel legal proceedings concerning GDPR compliance - administrative law and civil law - of the same data subject in a Member State. In that case, among other things, the relationship between public and private law enforcement under the GDPR is at the forefront. According to TikTok et al., the arrest serves the importance of a uniform interpretation and application of the GDPR, the process economy and process efficiency and guarantees the rights of TikTok et al.
5.24.
The foundations oppose the continuation of the procedure.
5.25.
Whether there are sufficient grounds for arrest is mainly determined by the requirements of due process, including the requirements of an efficient and expeditious administration of justice. The court must guard against an unreasonable delay in the proceedings. In view of the stage at which these proceedings have reached, the requirements of good procedural order preclude arrest. It is important here that no substantive treatment of the claims will yet take place in the next phase (‘the second phase’). In that second phase, the topics to be discussed are: the admissibility of the foundations, the applicable law and the appointment of an exclusive representative. The substantive debate will only start after the parties have taken deeds, the oral hearing has taken place and a decision has been made on the aforementioned subjects. There is therefore currently no risk that conflicting or – in answering the questions referred – incompatible decisions with EU law will be taken, but the procedure would be unreasonably delayed if arrested. For that reason alone, the request for arrest cannot be granted at this time.
Conclusion and costs of the proceedings
5.26.
The court rules that it is competent to take cognizance of the claims of the foundations, it rejects the defenses put forward by TikTok et al. (number 4.1 under I). TikTok et al.'s requests for arrest (number 4 under II) are also rejected.
5.27.
With this judgment, the dispute about jurisdiction and the request for arrest has been decided. TikTok et al. has been unsuccessful. The decision on the costs of the proceedings and the subsequent costs is reserved until a further verdict.
Appeal
5.28.
TikTok et al. has requested to allow an interim appeal against the decision on jurisdiction and the rejection of its requests. Pursuant to Article 337, paragraph 2 DCCP, an appeal can only be lodged against an interim judgment at the same time as that of the final judgment, unless the court has determined otherwise. There is no reason to make an exception to the main rule, given the delay that this entails. In this case, there are no compelling interests or special procedural reasons to deviate from the basic principle that no interim appeal is allowed. TikTok et al.'s request is denied.
The continuation of the procedure
5.29.
The procedural order was established in the role decision of February 23, 2022. The first phase of the procedure has been concluded with this judgment. This marks the start of the second phase, which relates to the admissibility of claimants, the applicable law and the appointment of an exclusive representative.
5.30.
The following is important with regard to the second phase of the procedure. The Explanatory Memorandum to the WAMCA states the following:
“Part c sets requirements for the financial resources that an interest organization must have. This gives the court the opportunity to assess whether a legal entity that institutes a collective action has sufficient resources to conduct the proceedings. Where necessary, the court may request access to the organisation's books, if necessary to be inspected by a third party to be designated by it, without this creating the obligation to also provide this information to the other party. In the event that a construction with Third Party Litigation Funding is opted for, the court may, on the basis of this requirement in combination with the general requirement of the sufficiently secured interests, inter alia request the financing agreement to examine how the financier's influence on the procedure has been arranged and whether that regulation does not stand in the way of careful representation of the interests of the injured parties. The assessment of this part can of course only be marginal. It is sufficient that a legal person can indicate that, at the time of the assessment, it has or can dispose of sufficient resources to be able to conduct the procedure. Incidentally, it is not necessary that the other party also has access to the financing agreement (HR December 20, 2002, NJ 2004, 4, Lightning Casino/Antilles).”11
5.31.
In this case, with a view to assessing the admissibility of each of the claimants and partly with a view to the appointment of an exclusive representative, the court sees grounds for ordering each of the claimants on the basis of the provisions of Article 22 paragraph 1 DCCP. to submit the financing agreement with the litigant financier, on the understanding that it will be determined, subject to analogous application of article 22 paragraph 2 DCCP, that the agreements need not be provided to the other party, but that only the court will take cognizance of them.
5.32.
For the purpose of the second phase of the procedure, a term will be determined below for:
- ((i) the deed of each of the claimants about
(a) the designation of an exclusive representative and
(b) submitting the financing agreement with the litigation funder and
- ((ii) defendants' conclusion on
(a) the admissibility of claimants,
(b) applicable law and
(c) the designation of an exclusive representative.
The date of the oral hearing in the second phase will then be determined. In principle, no reply or rejoinder is allowed at this stage.
5.33.
Any further decision is reserved
6 The decision
The court
6.1.
refers the case to the roll of December 21, 2022 for deed on the part of each of the plaintiffs regarding (a) the appointment of an exclusive representative and (b) the submission to the court of the financing agreement with the litigant financier in the manner provided in legal consideration 5.31;
6.2.
refers the case to the roll of February 1, 2023 for deed on the part of TikTok et al. regarding (a) the admissibility of claimants, (b) the applicable law and (c) the appointment of an exclusive representative and
6.3.
reserves any further decision.
This judgment was rendered by mr. R.H.C. Jongeneel, mr. M.L.S. Kalff and mr. R.P.F. de Groot, judges, assisted by mr. C.E.P. Honey, Clerk, and pronounced in public on November 9, 2022.12
Appendix
Claims SOMI
Exclusive Advocate
I. to appoint SOMI as exclusive representative within the meaning of Article 1018e paragraph 1 DCCP;
Represented victims
Primary
II. To determine that in this collective action SOMI represents the interests of the following narrowly defined groups of persons within the meaning of Article 1018e paragraph 2 DCCP (jointly the "Narrowly Defined Groups"):
a. All natural persons with habitual residence in the Netherlands who have used the TikTok App after May 25, 2018 and who had not yet reached the age of 13 at the time of first use after May 25, 2018 ("Closely Described
Group A");
All natural persons with habitual residence in the Netherlands who have used the TikTok App after May 25, 2018 and who were 13, 14 or 15 years old at the time of first use after May 25, 2018 ("Closely Described Group B");
All natural persons with habitual residence in the Netherlands who have used the TikTok App after May 25, 2018 and who were 16 or 17 years of age at the time of first use after May 25, 2018 ("Closely Described Group C");
alternative
III. To determine that in this collective action SOMI represents the interests of the victims affiliated to it by means of the Participation Agreement ("Notified Victims"), whereby the Notified Victims are divided into the following groups:
All Notified Victims with habitual residence in the Netherlands who have used the TikTok App after May 25, 2018 and who had not yet reached the age of 13 at the time of first use after May 25, 2018 ("Notified Victims Group A");
All Notified Victims with habitual residence in the Netherlands who have used the TikTok App after May 25, 2018 and who were 13, 14 or 15 years old at the time of first use after May 25, 2018 ("Notified Victims Group B");
All Notified Victims with habitual residence in the Netherlands who have used the TikTok App after May 25, 2018 and who were aged 16 or 17 at the time of first use after May 25, 2018 ("Notified
Victims Group C");
Statements of law
IV. Declare that TikTok, for the reasons set out in the body of this summons, is in violation of the EU Charter of Fundamental Rights, the EU General Data Protection Regulation, the Telecommunications Act, mandatory consumer law provisions and/or the Media Act;
V. Declare that TikTok is liable under Article 82 of the GDPR and/or Article 6:162 of the Dutch Civil Code to any member of the Narrowly Described Groups, or alternatively to any Notified Victim, for the harm suffered by that member or by that Notified Victim and damage to time;
VI. Declare that:
a. The Privacy Policy, the Terms of Use and the Virtual Items Policy of TikTok for the Victims are incomprehensible and unclear in their entirety, at least that the stipulations therein to be judged by your court are incomprehensible and unclear to the Victims, and therefore voidable;
Article 6, Article 9 and Article 12 of the Terms of Use and the full Virtual Items Policy of TikTok are unreasonably onerous, and thus voidable;
TikTok engages in misleading and unfair trade practices with its Coin, Gift and Diamond trading practices;
TikTok acts in violation of Article 3:15e and 6:193b of the Dutch Civil Code and Article 3a.5 Media Act by not making commercial communication recognizable as such in the TikTok App;
TikTok must take appropriate measures to ensure that minors are protected from videos that may impair their physical, mental or moral development;
Destruction of Terms
VII. Annul the entire agreement regarding the use of the TikTok App between TikTok and Victims who have not yet reached the age of 16 at the time of the judgment in this case;
VIII. Annul Articles 6, 9 and 12 of the Terms of Use and the entire Virtual Items Policy of TikTok, as they apply between the Victims and TikTok, with regard to the Victims named in claim VIII: alternatively to that claim;
Erasing personal data
IX. Order TikTok to irreversibly delete all personal data of Victims who have not yet reached the age of 16 at the time of the judgment in this case and to provide SOMI with proof thereof;
Orders for the protection of minors
X. to recommend TikTok to:
Implement an effective system that allows it to verify the age of individuals registering to use the TikTok App and to ensure that children under the age of 13 cannot use the TikTok App;
Implement an effective system by which it ensures that for processing of personal data of children under the age of 16, for which consent is required as a legal basis, this consent can only be granted by the parents or legal representatives of the child;
Implement an effective system to ensure that minors cannot view videos that may impair their physical, mental or moral development, including a system that allows parents or legal representatives of minors to effectively control and manage which videos these minors can view, without that TikTok will therefore process more personal data of these parents or legal representatives than is strictly necessary for that purpose;
Take appropriate measures to make commercial communications recognizable as such in the TikTok App;
To draw up and publish a code of conduct in accordance with Article 3a.3 Media Act;
Compensation
XI. TikTok to condemn the immaterial harm of every member of the Closely Defined
Compensate groups, alternatively to any Notified Victim;
Primary
XII. Estimating the damage at:
a. An amount of €2,000 (in words: two thousand euros) per member of Narrowly Described Group A, alternatively per member of Notified Victims of Group A;
An amount of €1,000 (in words: one thousand euros) per member of Closely Specified Group B, alternatively per member of Notified Victims of Group B;
An amount of €500 (in words: five hundred euros) per member of Closely Specified Group C, alternatively per member of Notified Victims Group C,
to be increased by the statutory interest from the date of the judgment to be rendered in this case until the date of full payment;
alternative
XIII. To estimate the damage at an amount or amounts to be determined by your court in good justice, plus the statutory interest from the date of the judgment to be rendered in this case until the day of full payment;
More subsidiary
XIV. To determine that the damage suffered by the members of the Narrowly Described Groups, alternatively the Notified Victims, will be further drawn up by the state and will be settled in accordance with the law;
Claim settlement
Primary
XV. Order TikTok to pay SOMI within six weeks of the date of the judgment to be rendered in this case:
Primary
a. All damages awarded to the members of the Narrowly Described Groups on the basis of the judgment to be rendered in this case, assuming 510,000 members in Narrowly Described Group A, 298,000 members in Narrowly Described Group B and 196,000 members in Narrowly Described Group C, and thus a total amount of €1,416,000,000 (in words: one billion four hundred and sixteen million euros), at least a number of members and/or amount to be determined in due course by your court, and thereby determining that any part of the total amount that remains twenty-four months after payment by TikTok, at least a term to be determined by your court in good justice, may be paid out by SOMI to one or more non-profit organizations to be designated by SOMI that are active in the area of minors, privacy and/or consumer protection;
alternative
All damages awarded to the Notified Victims on the basis of the judgment to be rendered in this case, based on the further
SOMI to specify the number of members in the different groups of Reported Victims, at least a number of members to be determined in due course by your court, and thereby determining that any part of the total amount that will be paid twenty-four months after payment by TikTok, at least one by your period to be determined by a court in good justice, still remaining, may be paid out by SOMI to one or more non-profit organizations to be designated by SOMI that are active in the field of minors, privacy or consumer protection;
Primary and subsidiary
An amount of € 5,000,000 (in words: five million euros), at least an amount to be specified by SOMI, or at least an amount to be determined by your court in good justice, which will serve as compensation for the costs to be incurred by SOMI of the distribution of indemnities among the members of the Narrowly Specified Groups, alternatively the Notified Victims, stipulating that any part of this amount that will remain after the distribution of the indemnities has been completed and all related costs of SOMI have been reimbursed, within will be reimbursed to TjkTok for sixty days, alternatively stipulating that SOMI will be allowed to deduct the costs of distributing compensation among the members of the Narrowly Described Groups, alternatively the Notified Victims, from the compensation to be paid by or on behalf of SOMI;
XVI. To determine that SOMI may deduct from the compensation to be paid by or on behalf of SOMI to the members of the Narrowly Specified Groups a market-based compensation to be specified by SOMI for services provided by SOMI, including a reasonable surcharge for ( future) collective advocacy and costs of using equity or debt;
XVII. To determine that SOMI will engage the assistance of a reliable and professional claims handler to ensure the proper distribution of the damages to be paid by TikTok;
XVIII. To determine that the members of the Narrowly Specified Groups, alternatively the Notified Victims, who wish to be eligible for payment of compensation, must agree to a binding advice procedure with regard to the determination by the claims handler of the right to compensation and with with regard to the distribution of the compensation, whereby an independent person with sufficient expertise to be designated by your court, after consultation with the parties, will act as binding advisor;
alternative
XIX. Shaping the collective claim settlement in such a way as your court deems advisable on the basis of (a) proposal(s) for a collective settlement of damage to be submitted by SOMI and TikTok pursuant to Article 1018i DCCP;
Litigation costs and extrajudicial costs
Primary
XX. Order TikTok to pay the costs of these proceedings, including the reasonable and proportionate costs of the proceedings, the extrajudicial costs and other costs incurred by SOMI, including any compensation to be paid by SOMI to a financier, such on the basis of Article 10181 paragraph 2 DCCP , at least on the basis of Article 237 DCCP, or at least on the basis of Article 6:96 of the Dutch Civil Code, all this as further estimated by SOMI and increased by the statutory interest from the date of the judgment to be rendered in this case until the day of total satisfaction;
alternative
XXI. To determine that SOMI may deduct the costs of these proceedings, including the reasonable and proportionate legal costs, the extrajudicial costs and other costs incurred by SOMI, including any compensation to be paid by SOMI to a financier, from the compensation to be paid on its behalf.
Claims STBYP
I. Appointment of exclusive representative
(i) To designate the Foundation as the exclusive representative within the meaning of Article 1018e paragraph 1 DCCP.
II. Definition of the narrowly defined group
-
i) Primary: to determine that in this collective action the Foundation represents the interests of the following group of natural persons, which forms a narrowly defined group within the meaning of Article 1018d DCCP:
-
a) all natural persons with habitual residence in the Netherlands who have used the TikTok App after May 25, 2018 and who had not yet reached the age of 18 at the time of first use, including all users of predecessors of the TikTok App , such as musical.ly, and users of the web browser version of the TikTok application (“Narrowly Defined Group”); and
-
b) stipulating that every person of the Narrowly Described Group who is domiciled or domiciled in the Netherlands, during a period of three months after the announcement within the meaning of Article 1018f paragraph 3 DCCP of the decision designating the Foundation as exclusive representative has the opportunity to notify the registry of the court in writing that he/she opts out of the representation of their interests in this class action (“Opt Out”).
-
ii) In the alternative: to determine that in this class action the Foundation represents the interests of:
-
a) All natural persons with a habitual residence in the Netherlands who have used the TikTok App after May 25, 2018, and who had not yet reached the age of 13 upon first use (“Closely Described Group I”);
-
b) All natural persons with habitual residence in the Netherlands who have used the TikTok App after May 25, 2018, and who were 13, 14 or 15 years old when first used (“Closely Described Group II”);
-
c) All natural persons with habitual residence in the Netherlands who have used the TikTok App after May 25, 2018, and who were 16 or 17 years of age when using it for the first time (“Closely Described Group III”); and
-
d) stipulating that every person in the Narrowly Described Groups I, II and III who resides or has domicile in the Netherlands, during a period of three months after the announcement within the meaning of Article 1018f paragraph 3 DCCP of the decision to designate of the Foundation as an exclusive representative has the opportunity to notify the registry of the court in writing that they are withdrawing from the representation of their interests in this class action.
-
iii) More in the alternative: to determine that in this collective action the Foundation represents the interests of the persons affiliated with it by means of a Participation Agreement (“Registered Participants”).
III. Declaration of Justice
(i) Primary: declare that
-
a) TikTok acts in violation of the fundamental rights mentioned in the summons, the General Data Protection Regulation, consumer law, the Telecommunications Act and the revised Audiovisual Media Services Directive for the reasons set out in the body of this summons against the Narrowly Described Group, and
-
b) that the Defendants are jointly and severally liable under Article 82 of the GDPR and/or Article 6:162 of the Dutch Civil Code and/or 6:212 of the Dutch Civil Code towards any natural person who is a member of the Narrowly Described Group, and on that account the must compensate for damage suffered and yet to be suffered, including statutory interest;
(ii) In the alternative: declare that
-
a) TikTok acts in violation of the fundamental rights mentioned in the summons, the General Data Protection Regulation, consumer law, the Telecommunications Act and the revised Audiovisual Media Services Directive for the reasons set out in the body of this summons against the Registered Participants, and
-
b) that the Defendants are jointly and severally liable under Article 82 of the GDPR and/or Article 6:162 of the Dutch Civil Code and/or 6:212 of the Dutch Civil Code towards any natural person who is a member of the Registered Participants, and on that account the suffered by that natural person and still to suffer damage, including statutory interest.
(iii) Declare that TikTok's Terms of Use, Privacy Policy, Virtual Items Policy, Cookie Policy, Community Guidelines and Intellectual Property Policy are voidable by the persons in
the Narrowly Described Group and on their behalf by the Foundation for the reasons described in the body of this summons.
-
iv) Declare that:
-
a) TikTok must take appropriate measures to ensure that the personal data of users of the TikTok App under the age of 18 is not transferred to countries outside the EEA, unless the requirements applicable under the GDPR are met;
-
b) TikTok must take appropriate measures to ensure that users of the TikTok App under the age of 18 are not exposed to videos on the TikTok App that may impair their mental or physical development;
-
c) TikTok must take appropriate measures to implement an age verification system that is based on a scan of an identity document, or at least an appropriate system that provides reasonable certainty about the age of the user of the TikTok App, and must take appropriate measures in order to be able to verify that parental consent to create an account has been given, where required;
-
d) TikTok must take appropriate measures to stop placing cookies and other tracking technologies on the devices used by the persons in the Closely Defined Group, except cookies that comply with the requirements set by the GDPR and the Telecommunications, and only to the extent that these are essential for the operation of the TikTok App.
IV. Destruction of Terms
(i) Declare the nullification of the agreement regarding the use of TikTok between any person of the Closely Defined Group on the one hand and TikTok on the other, including the destruction of the TikTok Documentation, including the Terms of Use, the Privacy Policy, the Virtual Items Policy, the Cookie Policy , the Community Guidelines and TikTok's Intellectual Property Policy with regard to persons in the Narrowly Defined Group, for the reasons described in the body of this subpoena, or destruction of those parts of the TikTok Documentation that the court deems voidable.
V. Orders to Protect Children
-
i) Instruct TikTok to take measures within a period of three months from the date of the judgment to be made to properly:
-
a) verify that the users are at least 13 years of age;
-
b) verify that users under the age of 18 have obtained the required permission from a legal representative such as a parent or guardian to use the TikTok App;
-
ii) instruct TikTok to close all existing accounts of the Narrowly Described Group within a period of three months from the date of the judgment to be made and to destroy all personal data collected and processed from or about these users:
-
a) to the extent that users have not yet reached the age of 13 or that their age cannot be determined with certainty and in a verifiable manner;
-
b) insofar as users have not yet reached the age of 18 and no explicit and verifiable consent has been obtained from a legal representative, or the consent cannot be established with certainty.
-
iii) prohibit TikTok from applying to the Narrowly Described Group terms that conflict with the requirements of consumer law as described in the body of this subpoena.
-
iv) Order TikTok to cancel the TikTok Documentation vis-à-vis the Closely Defined Group, which should at least include:
-
a) refund of the purchase amounts of Coins purchased by the Children;
-
b) irreversibly erase all collected personal data of the Closely Described Group, including personal data that has been provided to third parties or that has been used for the purpose of advertising sales to third parties, unless TikTok receives permission from the natural person concerned within three months that the personal data does not have to be be erased;
-
c) insofar as TikTok is not, or is difficult, to undo the actions under (a) and (b) to compensate the Narrowly Described Group for this on the basis of Article 3:53 paragraph 2 of the Dutch Civil Code,
the orders under V (i), (ii), (iii) and (iv) subject to a penalty of EUR 1,000 per user per injunction or prohibition violated per day that the violation continues up to a maximum of EUR 25,000 per user.
Also apart from the above obligation to undo:
-
v) Order TikTok to irreversibly erase all personal data of the persons in the Narrowly Described Group, unless TikTok obtains permission from the person concerned within three months that the personal data does not have to be erased.
-
vi) to order TikTok to take further measures to put its security in order, and in any case to take measures so that the security risks as described in chapter 5 sub D of this summons no longer exist within three months.
-
vii) order TikTok to end the violation of the Telecommunications Act, and to instruct all persons in the Narrowly Described Group on how to delete already placed cookies and other tracking techniques.
-
viii) Order TikTok to no longer transfer the personal data of users of the TikTok App under the age of 18 to countries outside the EEA, unless the requirements applicable under the GDPR are met, and all personal data of the Closely Described Group that have already been sent to these third countries outside the EEA;
VI. Order to pay compensation
-
i) Order each of the Defendants jointly and severally to pay the immaterial damage of all persons in the Narrowly Specified Group, which damage can be estimated at:
-
a) An amount of EUR 1,500 (fifteen hundred euros) per natural person in the Narrowly Described Group who had not yet reached the age of 13 when using the TikTok App for the first time.
-
b) An amount of EUR 1,250 (twelve hundred and fifty euros) per natural person in the Narrowly Described Group who had reached the age of 13 when using the TikTok App for the first time, but not yet 16 years of age.
-
c) An amount of EUR 1,000 (thousand euros) per natural person in the Narrowly Described Group who had reached the age of 16 when using the TikTok App for the first time, but not yet 18 years of age.
These amounts to be increased by the statutory interest from the date of the judgment to be rendered in this case, until the day of full payment.
-
d) In the alternative: to determine that the damage suffered by the Children is determined in good justice by your court, plus statutory interest from the date of the judgment to be rendered until the day of full payment;
-
e) More in the alternative: to determine that the damage suffered will be further drawn up by the state and will be settled as prescribed by law, to increase this damage again with statutory interest from the date of the judgment to be rendered until the day of full payment .
-
ii) Order each of the Defendants jointly and severally to pay the material damage of all persons in the Narrowly Described Group, which damage is determined by your court in good justice, whether or not on the basis of Articles 6:97 and/or 6:104 of the Dutch Civil Code , to be increased by statutory interest from the date of the judgment to be rendered until the date of full payment;
-
a) In the alternative: to order each of the defendants jointly and severally to pay the material damage of all persons in the Narrowly Specified Group, which damage will already be drawn up by the state and will be settled as prescribed by law, plus statutory interest from the date of the judgment to be rendered until the day of full payment
VII. Suspension of claims settlement
-
i) Determine that the Defendants must pay jointly and severally, within six weeks of the judgment to be rendered in this case:
-
a) To the Foundation all amounts accruing to the Foundation and Closely Specified pursuant to this claim, by transfer of this amount to a trust account to be specified by the Foundation of a law firm or notary's office in the Netherlands with a good name and reputation, and further determining that the amount to be paid will be EUR 2,000,000,000 (two billion euros), with the joint and several liability for Defendants to make further payments, if during the settlement of the claim the Narrowly Specified Group is found to have a higher aggregate claim for damages (due to a higher number of natural persons in the Narrowly Described Group, a lower average age of the persons when first using the TikTok App, or a combination thereof), and the stipulation that any part of the amount paid by the Defendants will be refunded after 30 months. after payment, or after a period to be determined by your court, the Foundation may pay out to an o f more non-profit organizations to be designated by the Foundation that are active in the field of privacy or consumer protection.
-
b) to pay to the Foundation an amount of EUR 4,500,000 (four million five hundred thousand euros), at least an amount to be determined by the court in good justice, which will serve to enable the Foundation to pay the costs of settling the compensation with the joint and several obligation of the Defendants to make further payments, if during the settlement of claims it appears that the costs are higher than estimated, and stipulating that if any part of the amount remains after the distribution of damages has been completed and all related costs have been paid, the Foundation will ensure that within 90 (ninety)
days the balance will be refunded to an account to be specified by the Defendants.
In the alternative: to determine that the Foundation may deduct the costs of the division of the collective compensation from the compensation to be paid to the Narrowly Specified Group.
-
ii) Determining that the Foundation will hire a reputable professional claims handler and instruct the indemnities to be distributed among the natural persons in the Narrowly Specified Group, all under the supervision of the Foundation;
-
iii) To determine that natural persons in the Narrowly Specified Group who wish to be eligible for a payment must agree to a binding advice procedure, whereby the court will appoint a binding advisor at the request of the Foundation;
-
iv) Order the Defendants to fully cooperate in the performance of the collective settlement of claims, which cooperation includes, among other things, that the Defendants will draw the attention of all Dutch users to the collective settlement of claims via the TikTok App via the TikTok App, and will forward the users to an address or website to be determined by the claims handler, and the Defendants will provide the Foundation with contact details of the persons in the Narrowly Described Group;
-
v) In the alternative: to design the collective settlement of claims in such a way as your court deems advisable on the basis of proposals for a collective settlement to be submitted by the Foundation and the Defendants pursuant to Article 1018i DCCP
VIII. Litigation costs and extrajudicial costs
(i) Order each of the Defendants jointly and severally to pay compensation to the
Founding:
-
a) The full, actual legal costs of this lawsuit, extrajudicial costs and further costs incurred by the Foundation, on the basis of Article 1018l paragraph 2 DCCP, and/or 237 DCCP and/or 6:96 DCC, all this to be increased by the statutory interest from the date of the judgment to be rendered until the day of payment in full;
-
b) The full (extrajudicial) costs incurred by the Foundation and costs still to be incurred in the context of the settlement of the claim, pursuant to Article 6:96 of the Dutch Civil Code, to be increased by the statutory interest from the date of the judgment until on the day of complete satisfaction,
-
c) The compensation to be paid in full by the Foundation to the Funder, pursuant to Article 6:96 of the Dutch Civil Code and/or
Article 1018l paragraph 2 DCCP, as further estimated on the basis of information to be submitted by the Foundation.
Claims SMC
Claim I: exclusive representative
I. Designate the Foundation as the exclusive representative within the meaning of Article 1018e paragraph 1 of the Dutch Civil Code;
Claim II: Definition Closely Defined Groups
II. To determine that the present collective action relates to the following group of natural persons within the meaning of Article 1018d DCCP:
The group of natural persons harmed by TikTok (hereinafter: “Narrowly Defined Group 1”) and which consists of:
all natural persons;
who have used the TikTok Service;
iii. at a time or during a period that they lived or stayed in the Netherlands, after the entry into force of the GDPR; and
iv. who had not yet reached the age of 13 at the time of first use;
The group of natural persons harmed by TikTok (hereinafter: “Closely Defined Group 2”) and which consists of:
all natural persons;
who have used the TikTok Service;
iii. at a time or during a period that they lived or stayed in the Netherlands, after the entry into force of the GDPR; and
iv. who were 13, 14, 15, 16 or 17 years old at the time of first use;
The group of natural persons harmed by TikTok (hereinafter: “Narrowly Defined Group 3”) and which consists of:
all natural persons;
who have used the TikTok Service;
iii. at a time or during a period that they lived or stayed in the Netherlands, after the entry into force of the GDPR; and
iv. who were 18 years of age or older at the time of first use.
Claim III: opt-out/in possibility
III. To determine that:
(The legal representatives of) every member of the Narrowly Described Group 1, 2 or 3 who resides or has domicile in the Netherlands during a period of three months after the announcement within the meaning of article 1018f paragraph 3 DCCP of the decision designating the exclusive representative, will have the opportunity to notify the clerk of the court in writing to withdraw from the representation of their interests in this class action; and
(The legal representatives of) every member of the Narrowly Described Group 1, 2 or 3 who resides or has domicile outside the Netherlands, during a period of six months after the announcement within the meaning of Article 1018f paragraph 3 DCCP of the decision to designate of the exclusive representative, will have the opportunity to notify the registry in writing that they agree to the representation of their interests in this collective action.
Claim IV and V: Declarations of Justice
IV. Declare that TikTok, for reasons set forth in the body of this subpoena, violates the fundamental principles referred to in the body of this subpoena
(children's) rights and/or the obligations arising from the GDPR and/or the
Telecommunications Act and/or mandatory provisions of consumer law and/or the Media Act, has behaved unlawfully, or at least acts contrary to its statutory duty(s) and/or the due care that may be expected of it in society;
V. Declare that each of TikTok Technology Limited, TikTok Information Technologies UK Limited, TikTok Inc., ByteDance Ltd., TikTok Ltd, TikTok Pte. Ltd. and
Beijing ByteDance Technology Co., Ltd., is jointly and severally liable towards each member of the Narrowly Defined Groups under Article 82 GDPR and/or Article 6:193j paragraph 2 DCC and/or Article 6:162 DCC, at least Article 6: 212 BW, for the damage suffered and yet to be suffered by each of those members;
Claims VI-VIII: Prohibited
VI. Prohibit TikTok from processing personal data and/or engaging in unfair commercial practices in violation of the legal obligations referred to under claim IV (a);
VII. prohibit TikTok from transferring personal data of the persons in the Narrowly Described Groups to countries outside the EEA, unless the applicable requirements of the GDPR are met;
VIII. Primary: prohibit TikTok from processing personal data of underage users for commercial purposes, including the creation of personality or user profiles (profiling) and behavioral advertising;
In the alternative: to order TikTok to be transparent in a child-oriented manner about the functioning of the algorithm and the consequences this may have for children, so that children can make an autonomous choice whether or not they use the TikTok Service.
Claim IX: Annulment of unreasonably onerous terms
IX. Annul the unreasonably onerous terms in the Terms of Use and the Virtual Items Policy, as described in the body of the subpoena;
Claim X: Protection of children
X. Instruct TikTok to take appropriate measures to protect the rights and interests of children within three months of service of the judgment to be rendered, in particular by:
Implement an effective system to verify the age of users of the TikTok Service in order to effectively prevent persons under the age of 13 from using the TikTok Service;
Implement an effective system to ensure that users between the ages of 13 and under 16 can only use the TikTok Service with the consent of their parents or legal guardians and verify that such parental consent or authorization to consent has indeed been given;
Ensure that commercial communications distributed via the TikTok Service are always easily recognizable as such, including by offering a function that allows users to declare whether their videos contain audiovisual commercial communications and by obliging advertisers (contractually) to show the commercial nature to disclose in a clear and easily accessible manner and by also verifying this;
Take appropriate measures to protect minors against (user-generated) videos, challenges and commercial communications that may impair their physical, mental or moral development, including in any case the use of effective systems for user age verification and parental control in relation to to such content;
All accounts used by users under the age of 13, at least accounts for which it cannot be determined with certainty that the user is 13 years of age or older, and all accounts of users between 13 and 16 years old that were created without verifiable parental consent or legal representatives within the meaning of claim IX(b), and to delete all personal data of these users.
Claim XI: penalty payment
XI. To determine that the above commandments and prohibitions as mentioned under VI, VII, VIII and X
be imposed subject to forfeiture of a penalty of € 2,500, at least an amount to be determined by your court in good justice per user per violation thereof and
€250, at least an amount to be determined by your court in good justice per day that that violation per user continues with a maximum of € 10,000, at least an amount to be determined by your court in good justice, per violation per user;
Claim XII: Order to pay damages
XII. Any of TikTok Technology Limited, TikTok Information Technologies UK Limited, TikTok
Inc., ByteDance Ltd., TikTok Ltd, TikTok Pte. Ltd. and Beijing ByteDance Technology Co., Ltd., jointly and severally, to the extent that one has paid the other to that extent, to pay compensation for the (immaterial and material) damage, which damage, whether or not estimated on the basis of of article 6:104 of the Dutch Civil Code,
a. amounts to €6,171,427,500 in total for the Nauw Omscheven Groups, plus the statutory interest from the date of this summons, or at least from a date to be determined in good justice by your court until the date of the overall satisfaction;
at least
€1,750 per person in the Narrowly Described Group 1, €1,500 per person in the
Closely Described Group 2 and € 1,250 per person in the Closely Described Group 3, to be increased by the statutory interest from the date of this summons, or at least from a date to be determined in good justice by your court until the day of the full fulfilment;
at least
To determine that the damage suffered and yet to be suffered by Narrowly Specified Groups under the terms of the summons shall be further drawn up by state and settled as prescribed by law;
Claim XIII: Litigation costs and fees
XIII. Any of TikTok Technology Limited, TikTok Information Technologies UK Limited, TikTok
Inc., ByteDance Ltd., TikTok Ltd, TikTok Pte. Ltd. and Beijing ByteDance Technology Co., Ltd., jointly and severally, to the extent that one shall have paid the other shall be discharged to that extent, to reimburse to the Foundation:
The full legal costs of the Foundation pursuant to Article 1018l, paragraph 2 DCCP, or at least the actual legal costs incurred pursuant to Article 237 DCCP, to be increased by the statutory interest from the date on which these respective legal costs were incurred, or at least of a a date to be determined by your court in good justice until the day of full payment; and
The (extrajudicial) costs incurred in full by the Foundation pursuant to Article 6:96 of the Dutch Civil Code, to be increased by the statutory interest from the date on which these respective legal costs were incurred, or at least from a date to be determined in good justice by your court until the day of complete satisfaction,
What amounts a. and b. must be jointly budgeted in more detail; and
The compensation to be paid in full by the Foundation to the Lender, pursuant to Article 6:96 of the Dutch Civil Code and Article 1018l, paragraph 2 DCCP, as estimated in more detail on the basis of information to be submitted by the Foundation in more detail, and to be increased by the statutory interest from the date of the judgment to be given in this case until the date of full payment;
Claim XIV: Method of settlement of collective damage XIV.
To determine that:
a. TikTok will pay to the Foundation:
all amounts to be paid to the Foundation and the Narrowly Described Groups pursuant to this claim, assuming 738,720 members of the Narrowly Described Group 1, 616,770 members of the Narrowly Described Group 2 and 3,162,810 members of the Closely Described Group 3, and to determine that any part that remains 24 months after payment by TikTok, at least a term to be determined by your court in good justice, may be paid out by the Foundation to one or more non-profit organizations designated by the Foundation that are active in the field of consumer and/or privacy protection,
to be increased by an additional amount to be estimated at a later date, or at least an amount to be determined in good justice, which will serve to cover the costs to be incurred by the Foundation for distributing the compensation among the members of the Narrowly Described Groups (hereinafter: "Additional Amount" ), provided that if and to the extent that any portion of the Additional Amount remains after the distribution among the members of Closely Defined Groups has been completed and all associated costs of the Foundation have been paid, TikTok will be refunded within 30 days ; and
The Foundation will hire a reputable professional claims handler and will instruct the proper distribution of the
TikTok to pay compensation among members of the Closely Described
to cater for groups, and
That the members of the Narrowly Described Groups who wish to be eligible for a payment must agree to a binding advice procedure, whereby a person will be appointed as binding advisor by the court after consultation with the parties, as to be determined by the Foundation and by Your court's approval;
at least
to shape the collective settlement of claims in such a way as your court deems advisable on the basis of the proposals for a collective settlement to be submitted by the Foundation and TikTok pursuant to Article 1018i DCCP.
1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC .
2 Regulation (EU) No 1215/2012 of 12 December 2012 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters.
3 Supreme Court 29 March 2019, ECLI:NL:HR:2019:443.
4 CJEU 19 January 1993, ECLI:EU:C:1993:15, CJEU 1 October 2002, ECLI:EU:C:2002:555 and CJEU 25 January 2018, ECLI:EU:C:2018:37.
5 CJEU 27 September 1998, ECLI:EU:C:1988:459 ([Party]) and CJEU 12 September 2018, ECLI:EU:C:2018:701 ([Party]).
6 CJEU 13 March 2014, ECLI:EU:C:2014:148 ([party]).
7 CJEU 10 September 2015, ECLI:EU:C:2015:547 ([party]).
8 CJEU 24 November 2020, ECLI:EU:C:2020:950 (Wikingerhof).
9 a.m. CJEU 28 January 2015, ECLI:EU:C:2015:37 ([lot] /Barclays Bank), CJEU 16 June 2016, ECLI:EU:C:2016:449 (Universal Music/[lot]).
10 CJEU 25 October 2011, ECLI:EU:C:2011:685 (eDate Advertising/ [party]).
11 Parliamentary Papers II, session year 2016–2017, 34 608, no. 3, p. 20.
12 type: CEPH col:
