Rb. Amsterdam - C/13/683377 / HA ZA 20-468
From GDPRhub
| Rb. Amsterdam - C/13/683377 / HA ZA 20-468 | |
|---|---|
 | |
| Court: | Rb. Amsterdam (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 77 GDPR Article 78 GDPR Article 79 GDPR Article 80 GDPR 4(1) Brussels I bis Regulation 7 Brussels I bis Regulation 8 Brussels I bis Regulation 67 Brussels I bis Regulation |
| Decided: | 12.12.2035 |
| Published: | 11.01.2008 |
| Parties: | Data Privacy Stichting (‘the Foundation’) Facebook Netherlands B.V., Facebook Inc., and Facebook Ireland Ltd. |
| National Case Number/Name: | C/13/683377 / HA ZA 20-468 |
| European Case Law Identifier: | Zoekresultaat - inzien documentECLI:NL:RBAMS:2021:3307 |
| Appeal from: | |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Rechtspraak.nl (in Dutch) |
| Initial Contributor: | Lisette Mustert |
The Data Privacy Foundation is allowed to litigate in a Dutch court against Facebook on behalf of Dutch users of the Facebook service, about whether Facebook has violated the right to data protection of its users.
English Summary
Facts
At the end of 2014, (the legal predecessor of) the Dutch Data Protection Authority (AP) launched an investigation into the processing of personal data of data subjects in the Netherlands by the Facebook group (Facebook Netherlands B.V., Facebook Inc., and Facebook Ireland Ltd.). In a report of 21 February 2017, published on 16 May 2017, the AP concluded that the Facebook group violated several articles of the Personal Data Protection Act (Wbp) when it comes to providing information about the processing of personal data for advertising purposes.
On 19 November 2019 the Data Privacy Stichting (‘the Foundation’) informed Facebook that it holds Facebook et al. responsible for violating the right to the protection of personal data of data subjects in the Netherlands, by referring, inter alia, to the report of the AP of 21 February 2017. The Foundation has asked Facebook whether it is prepared to enter into consultations about a settlement and has requested Facebook et al. to respond no later than 12 December 2019. In addition, the Foundation has announced that it will issue a summons if Facebook et al. does not (timely announce whether it) is prepared to enter into consultations.
In an email dated 12 December 2019, Facebook Ireland requested more information from the Foundation before considering the Foundation's request or providing an adequate response.
Following further email exchanges between the Foundation and Facebook Ireland on 20 and 24 December 2019, the Foundation issued the summons in the present proceedings on 30 December 2019.
The Dutch court will deal with the following questions brought forward by the Foundation and Facebook: - Whether it has jurisdiction to decide on the claims brought by the Foundation against Facebook. - Whether the Foundation’s claims against Facebook are admissible. - How the disagreement between the parties about the applicable law should be solved.
Dispute
Holding
Regarding the first point, the court held that with regard to Facebook Netherlands, the Dutch Court is competent on the basis of Article 2 Rv and Article 4(1) Brussels I bis Regulation. The court, furthermore, concludes that with regard to Facebook Ireland and Facebook Inc., the Dutch court is competent in accordance with Article 8, opening words and point 1 of the Brussel I bis Regulation and Article 7(1) Rv.
In situations to which both the Brussels I bis Regulation and the GDPR apply, the Brussels I bis Regulation cannot take away a competence conferred to a court by the GDPR. In this respect, the GDPR supplements the rules regarding the general jurisdiction of the Brussels I bis Regulation. In any case, the court is of the opinion that when the case is assessed in light of Article 79(2) GDPR, as have been argued by Facebook et al, this would not lead to a different outcome when it comes to the jurisdiction of the Dutch court. Article 79(2) GDPR provides that courts will have jurisdiction in a procedure instituted against a controller or processor. It is not in dispute that Facebook Ireland is the data controller with regard to the processing of the personal data at issue in these proceedings. In accordance with settled case law of the CJEU, Facebook Netherlands can be regarded as an establishment of Facebook Ireland. And, thus, the Dutch court has jurisdiction. In addition, the Dutch court can has jurisdiction in these proceedings with regard to Facebook Ireland from Article 79(2), second sentence, of the GDPR. That second sentence offers the possibility of also bringing proceedings in the courts of the Member State where the person concerned habitually resides. In this case, the data subjects whose personal data has been processed resides in the Netherlands. The Court does not agree that the Foundation, as a representative, cannot rely on the residence of the data subjects, as Facebook et al. has argued, since Article 80 of the GDPR explicitly offers the possibility of representation and states that the representative can exercise the rights of the data subjects without making a distinction between procedural and substantive rights. The foregoing means that both the first sentence and the second sentence of Article 79(2) GDPR (also) create jurisdiction for the Dutch court with regard to Facebook Ireland.
Regarding the second point, Facebook claims that the court should declare the Foundation inadmissible because, in short, the Foundation does not meet, inter alia, the (additional) admissibility requirements that apply to a collective action organization in accordance with Article 80 GDPR. The court, first, concludes that, in accordance with Dutch law, the Foundation is admissible in its collective action. Secondly, pursuant to Article 80(2) GDPR, the Union legislator has left it to the Member States to determine whether the organizations referred to in Article 80(1) GDPR also have their own right, which is independent of an instruction from the data subject, to exercise the possibilities provided for in Articles 77, 78 and 79 GDPR. Pursuant to Section 3:305a of the Dutch Civil Code (old), no instruction from the person concerned is required. Contrary to what Facebook has argued, the GDPR does not require the Foundation to have an assignment from the data subjects in these proceedings (in which only declarations of justice are claimed, and no compensation). When it comes to the question of whether the Foundation complies with the definition given in Article 80(1) of the GDPR, it is disputed between the parties whether the Foundation operates on a non-profit basis and whether it is active in the field of data protection. On the basis of Article 3.3 of the Articles of Association of the Foundation, however, it can be assumed that the Foundation is a non-profit organisation. Being active in the field of data protection as referred to in Article 80 of the GDPR should not be interpreted restrictively. The Foundation was established in 2019 and its activities are currently mainly focused on conducting these proceedings. In addition, the Foundation has a collaboration with the Dutch Consumers Association, it consults with other interest groups and this is being shared in the media. In view of this, the Foundation is active in the field of data protection, and thus, the requirements of Article 80 GDPR are met.
Regarding the third point, the parties have different opinions regarding the question of which law applies to the claims brought by the Foundation. They have asked the court to give an opinion on this already in this first phase of the procedure, prior to any substantive handling of the case. In so far as the claims relate to the period before 25 May 2018, it is important that the Privacy Directive is applicable during that period. Pursuant to Article 4(1)(a) of this Directive, each Member State shall apply its national provisions adopted pursuant to this Directive to the processing of personal data if it is carried out in the context of the activities of an establishment in the territory of the Member State of the controller. When the same controller has an establishment in the territory of several Member States, the controller must take the necessary measures to ensure that each of those establishments complies with the obligations imposed by the applicable national law. Article 4(1)(a) of the Privacy Directive makes it possible to apply the legislation on the protection of personal data of a Member State other than the one in which the data controller is registered. This requires that the controller carries out an activity in the context of which such processing takes place via a permanent establishment in the territory of that other Member State. According to the recital 19 of the Privacy Directive, an establishment as referred to in Article 4 of the same Directive presupposes the effective and real exercise of activities through stable arrangements. The Court concludes that, pursuant to Article 4 of the Privacy Directive, Dutch law can be applied to the data processing at issue.
In so far as the claims relate to the period after 25 May 2018, the GDPR is applicable. However, the parties do not agree on which implementing legislation applies. According to the Foundation, this is the Dutch Implementation Act of the General Data Protection Regulation (UAVG). According to Facebook, this is the Irish Data Protection Act 2018 (DPA 2018). The court finds that the GDPR does not contain a conflict of law rule on the basis of which it can be determined which national implementing legislation applies to a dispute of an international character to which the GDPR (also) applies. Contrary to the parties' opinion, Article 3 of the GDPR cannot be regarded as such a conflict rule. This means that it is necessary to assess whether this legislation is applicable on the basis of the territorial scope of national legislation. Pursuant to Article 4 paragraph 1 UAVG, this law and the provisions based on it apply to the processing of personal data in the context of activities of an establishment of a controller or processor in the Netherlands. This description is in line with the description in the GDPR and the Privacy Directive. In view of the case law of the CJEU, Facebook Netherlands must be regarded as an establishment of Facebook Ireland and Facebook Inc. (see what has been considered above about Article 4 of the Privacy Directive) and the UAVG can therefore be applied to this dispute.
All in all, the incidental claims for lack of jurisdiction and inadmissibility are rejected.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
Body
Court of Amsterdam
Date of judgment
30-06-2021
Date of publication
02-07-2021
Case number
C/13/683377 / HA ZA 20-468
Jurisdictions
Civil rights
Special characteristics
First instance - multiple
Content indication
The Data Privacy Foundation may litigate against Facebook on behalf of Dutch users of the Facebook service in the Dutch courts about whether Facebook has violated the privacy of its users.
Locations
Rechtspraak.nl
Enhanced pronunciation
Share pronunciation
print
Save as PDF
Copy link
Pronunciation
Judgment COURT AMSTERDAMA Division of private law case number / roll number: C/13/683377 / HA ZA 20-468 Judgment in the incident of June 30, 2021 in the case of the DATA PRIVACY STICHTING foundation, established in Amsterdam, plaintiff in the main action, defendant in the incidents, lawyer mr. J.H. Lemstra in Amsterdam, against 1. the private company with limited liabilityFACEBOOK NETHERLANDS B.V., with its registered office in Amsterdam,2. the legal entity under foreign law FACEBOOK INC., having its registered office in Menlo Park (California, United States),3. the legal person under foreign law FACEBOOK IRELAND LTD., with its registered office in Dublin (Ireland), defendants in the main action, claimants in the incidents, lawyer mr. G.H. Potjewijd in Amsterdam. Plaintiff shall hereinafter refer to the Foundation and defendants shall hereinafter refer to Facebook Nederland, Facebook Inc. and Facebook Ireland (jointly: Facebook et al).1 The procedure1.1.The course of the procedure is apparent from:-the identical writ of summons of December 30, 2019,-the deed of submission of exhibits of the Foundation of May 6, 2020,-the deed on jurisdiction, detention, admissibility and applicable law of Facebook et al. dated August 26, 2020, with exhibits, the statement of defense in the incident on jurisdiction, detention, admissibility and applicable law, also deed of amendment of claim, of the Foundation of 25 November 2020, with exhibits, - the interlocutory judgment of 27 January 2021, in which an oral hearing is determined, - the official report of the oral procedure, held on 1 April 2021, and the documents referred to therein. 1.2.Finally, a verdict has been determined in the incidents.2 The facts insofar as relevant in the incidents2.1.Facebook Netherlands, Facebook Ireland and Facebook Inc. belong to the Facebook group. This group offers a social network service (hereinafter also: the Facebook service). The Facebook service acts as a social media platform with which users can, among other things, share experiences and come into contact with information and people. More than 2.7 billion people worldwide use the Facebook service. The user does not pay any financial compensation for the Facebook service. The business model of the Facebook group is based on income from the sale of (personalized) advertisements. 2.2.Facebook Inc. was founded on February 4, 2004 and is headquartered in the United States. Facebook Ireland is a subsidiary of Facebook Inc. incorporated on October 6, 2008. Facebook Ireland acts as a contracting party for the provision of the Facebook service to users in the Netherlands (and Europe). In addition, Facebook Ireland also sells ads through a self-service advertising platform. Facebook Netherlands was founded on November 25, 2010. The (ultimate) parent company of Facebook Netherlands is Facebook Inc. Facebook Netherlands provides marketing and sales support services related to advertising sales to the Facebook group. In that context, Facebook Netherlands is engaged in, among other things, advising on and promoting the sale of advertising space on Facebook and other advertising products. For example, Facebook Netherlands advises companies and other organizations about advertising target groups and achieving marketing objectives with the help of the Facebook service.2.3.The Foundation is a collective claims foundation established on 25 February 2019. In addition to a board, it also has a supervisory board. 2.4.The articles of association of the Foundation read, insofar as relevant, as follows: “(…)DefinitionsArticle 1.In these articles of association, the following capitalized terms have the following meaning: Privacy Violation: the storage, transmission or processing of Data for the purpose of with regard to users of a product or service where: a. Data was obtained by fraud in any form whatsoever; b. it concerns Data from users who had less control over such Data than was (initially) stated, implied or implied in any way at the time such Data was obtained;c. Data is or is being stored, transferred or processed in any way contrary to the instructions or known intentions of the users; d. privacy rights or other related rights of users - contractual or otherwise - under control or property or the protection of their privacy and Data is violated;e. humiliate, demean, embarrass, or otherwise affect users in connection with Information about themselves, their family members, or their relationships; off. users are adversely affected in any way as a result of any wrongful act or omission in relation to their privacy rights, regardless of where in the world occurs. Data: Information that is held in digital form and which may be used in any of the following ways: a. to identify a person, by name or otherwise; b. to ascertain the characteristics, qualities, location or activities of any person, whether specifically identified or not; ofc. to ascertain the characteristics, qualities, location or activities of a group. Victims: (former) users and/or their legal guardians, not acting in the exercise of a profession or business, of products or services that can store, transfer or processing, against which users at any time a Privacy Violation takes place or has taken place while they were living in the Netherlands, and for whom the Foundation stands up for its purpose and who are not an Excluded Party, all in the broadest sense of the word.(…). Objectives and means.Article 3.3.1.The Foundation's objectives are: a. representing the interests of Victims towards whom a Privacy Violation takes place or has taken place at any time; b. investigating and establishing the unlawfulness and the direct or indirect liability for the aforementioned Privacy Violations and all consequences arising therefrom or otherwise with regard to the conduct as referred to above in Article 3.1 under a;c. the performance of all that is related to the provisions of Article 3.1 under a and Article 3.1 under b, or may be useful thereto, all this in the broadest sense of the word. (…) 3.3 The Foundation does not intend to make profit.(…) Compliance with the Claim Code. Article 7.7.1 The board is responsible for compliance with the Claim Code. (…)”2.5. The Foundation works together with the Consumers' Association and with the American law firm Lieff Cabraser Heimann & Bernstein LLP (hereinafter also: Lieff Cabraser). The latter finances the present proceedings and also provides (logistical) support.2.6.At the end of 2014, (the legal predecessor of) the Dutch Data Protection Authority (AP), the supervisory authority in the Netherlands in the field of data protection, initiated an investigation into the processing of personal data of data subjects. in the Netherlands by the Facebook group. In a report dated February 21, 2017, published on May 16, 2017, the AP reported on the findings. It concluded that the Facebook group is acting in violation of the Personal Data Protection Act (Wbp) on several points when it comes to providing information about the processing of personal data for advertising purposes.2.7.In a letter dated 19 November 2019, the Foundation let Facebook et al. know, inter alia with reference to the report of the AP of 21 February 2017, that the Facebook et al. Foundation holds responsible for privacy violations by consumers in the Netherlands. The Foundation has asked Facebook et al. whether it is prepared to enter into consultations about a settlement and has requested Facebook et al. to respond no later than December 12, 2019. In addition, the Foundation has announced that it will issue a summons if Facebook et al. is not prepared to enter into consultations (in good time or not).2.8.In an email dated 12 December 2019, Facebook Ireland sent more information to the Foundation before the Foundation's invitation can be considered or an adequate response can be given. 2.9.Following further email exchanges between the Foundation and Facebook Ireland on December 20 and December 24, 2019, the Foundation issued the writ of summons in the present proceedings on December 30, 2019.3 The claims in the main action3.1.In the main action, the Foundation is claiming , after amendment of the requirement, that the court is provisionally enforceable to the extent possible: a. declares in law that Facebook Netherlands, Facebook Ireland and Facebook Inc., jointly and/or each individually, from April 1, 2010 to January 1, 2020, at least during the period stated in paragraph 156 of the summons for each individual violation, at least during a the court has acted imputably wrongfully and/or acted against the constituents of the Foundation in due course of justice because they: i. has/have violated the (privacy) rights of the Constituents by, in violation of the (information) obligations of Articles 33 and 34 Wbp, or at least transferred the (information) obligations from Directive 95/46/EC to corresponding provisions in national privacy legislation of other Member States and/or Articles 12, 13 and 14 General Data Protection Regulation1 (GDPR):1. to allow, or at least enable and facilitate, that external developers could have and/or had access to personal data of the Constituents and subsequently process this personal data, without informing the Constituents about this sufficiently clearly and in a timely manner ; and/or2. to allow, or at least enable and facilitate, that [name] and/or Global Science Research Ltd., and/or Cambridge Analytica Ltd., Cambridge Analytica LLC and SCLE Elections Ltd., had access to and/or had access to personal data of the Constituents and could subsequently process this personal data, without informing the Constituents about this sufficiently clearly and in a timely manner; and/or3. telephone numbers of the Constituents that have been provided for the purpose of two-factor authentication, to be used for placing targeted advertisements, whether or not on the desktop version of its platform, without informing the Constituents about this sufficiently clearly and in a timely manner; and/or4. not to inform the Constituents, or at least to inform them insufficiently clearly and/or in a timely manner, about the 'integration partnership' program and the related processing of personal data concerning the Constituents; and/or the (privacy) rights of the Constituents have/have violated by:1. violation of the basis requirement from Article 6 and 8 Wbp, or at least corresponding provisions in national privacy legislation in other Member States, and/or violation of Article 5, first paragraph, under a, and Article 6, first paragraph, GDPR, always by data from the Constituents to process without such processing being able to be based on an adequate and legal basis for processing;2. violation of the processing ban for special data from Article 16 Wbp, or at least corresponding provisions in national privacy legislation in other Member States, and/or Article 9(1) GDPR, by in particular (but not exclusively) personal data relating to sexual life, religion and ethnicity, and the content of messages from the Constituents showing the use of such information for advertising purposes;3. violation of the information obligation and the consent requirement from Article 11.7a, first paragraph, of the Telecommunications Act (Tw), or at least corresponding provisions in national privacy legislation in other Member States, due to failure to inform, or not clearly or sufficiently and/or not in a timely manner, the Supporters about tracking surfing behavior and app use outside the Facebook service with the help of cookies and/or comparable technology and the use of the data obtained in this way for advertising purposes; and/or has/have conducted commercial practices towards the Supporters of the Foundation that are unfair in within the meaning of Section 6:193b, paragraph 1 of the Dutch Civil Code (BW) and/or are misleading within the meaning of Section 6:193c, 193d and 193g of the Dutch Civil Code, by:1. failing to inform the Constituents sufficiently clearly and/or in a timely manner about the collection and further processing of their (confidential) personal data in order to generate turnover, by sharing that personal data with third parties, or at least using that data for the benefit of third parties;2 . failing to inform its constituents sufficiently clearly and/or in a timely manner about the scale of the collection of these (confidential) personal data, and the sharing thereof with third parties, or at least the use thereof for the benefit of third parties;3. until at least August 2019 to make the misleading statement to the supporters that the Facebook service would be free and that it would always remain so, while the supporters de facto paid for the Facebook service by handing over the relevant (confidential) personal data to Facebook et al. declares that Facebook Netherlands, Facebook Ireland and Facebook Inc., jointly and/or each individually from April 1, 2010 to January 1, 2020, at least during the period stated in paragraph 156 of the summons for each individual violation, at least during a period to be determined by the court in good justice, have acted imputably wrongfully towards the Constituents by, through the Constituents, also the details of the friends of the Constituents on the above under ai1., ai2., ai3. , a.ii.1. and a.ii.3 unlawfully processed; declares in court that Facebook Netherlands, Facebook Ireland and Facebook Inc., jointly and/or each individually, is unjustified and/or enriched at the expense of the Constituents in the period from April 1, 2010 to January 1, 2020, at least for a period to be determined by the court in good justice; Facebook Netherlands, Facebook Ireland and Facebook Inc. is jointly and severally ordered to pay the legal costs incurred by the Foundation, to be increased by subsequent costs and statutory interest on the legal and subsequent costs.3.2. The word “Affiliates” used in the claim defines the Foundation, in short, as (former) users of the Facebook Service at any time during the period from April 1, 2010 to January 1, 2020 (and/or their legal guardians) to the extent that they were living in the Netherlands at the time of such use, not acting in the exercise of a profession or business, and for whom the Foundation stands up by virtue of its object description.3.3 The statements of the Foundation in the main action are discussed below in the assessment of the incidents, insofar as they are relevant. 3.3. Facebook et al. has not yet provided an answer in the main action. 4 The claims in the incidents4.1.Facebook et al. demand that the District Court, by judgment, provisionally enforceable insofar as possible: primary-a) declare itself incompetent with regard to the claims brought by the Foundation against Facebook et al.; and/or-b) declares the Foundation inadmissible in its claims against Facebook et al.; alternatively-c) suspends or continues the further handling of the present proceedings; and/or-d) declares Irish data protection and telecommunications law applicable to the Foundation's claims relating to the period prior to the entry into force of the GDPR, and declares the GDPR and Irish implementing legislation of the GDPR applicable to claims that relate to the period from the entry into force of the GDPR; and/or-e) declares that data protection law precludes consumer law claims (as lex generalis); and/or-f) if the court finds that the Foundation is allowed to base claims on consumer law, Irish consumer law law applies to the Foundation's consumer claims; both primarily and in the alternative-g) to the extent that the the court should reject the preliminary defense of Facebook et al. in whole or in part, determines that an interim appeal against this judgment is open; and-h) orders the Foundation to pay the costs of the proceedings, as well as the usual subsequent costs (with and without service), plus the statutory interest as referred to in Section 6:119 of the Dutch Civil Code within fourteen days of the date of this judgment.4.2 The Foundation puts forward a defense and concludes to reject the cross-appeal claims, ordering Facebook et al. to pay the costs of the incident. 4.3. The parties' arguments are discussed below, insofar as relevant.5 The assessment in the incident as to lack of jurisdiction 5.1. In dispute is the jurisdiction of the Dutch court. 5.2. The court will hereafter first assess its jurisdiction with regard to the claims brought by the Foundation insofar as they relate to the period before the entry into force of the GDPR on 25 May 2018. The jurisdiction to take cognizance of those claims must be assessed. on the basis of the Brussels I bis Regulation2 and the Code of Civil Procedure (Rv).5.3. After that, the court will assess its jurisdiction with regard to the claims brought by the Foundation insofar as they relate to the period from 25 May 2018. On this point, the parties disagree about how the jurisdiction regulation in the GDPR relates to the jurisdiction rules laid down in the Brussels I bis Regulation and Rv. Period until 25 May 2018Testing framework Brussels I bis Regulation and Rv 5.4. The Brussels I bis Regulation applies pursuant to Article 1 and Article 66 paragraph 1 of that Regulation to legal actions in civil and commercial matters instituted on or after 10 January 2015.5.5.According to the settled case law of the Court of Justice of the European Union (ECJ), the provisions of the Brussels Ia Regulation must be interpreted autonomously in the light of its genesis, objectives and system. The interpretation given by the ECJ with regard to provisions of the predecessor of the Brussels Ia Regulation, the Brussels I Regulation, also applies to the Brussels Ia Regulation when the provisions in question can be regarded as equivalent.5.6.The court who, on the basis of the Brussels Ia Regulation, investigates whether he has jurisdiction, should not limit himself in this investigation to the assertions of the claimant, but should take into account all information available to him about the actual legal relationship between the parties and, where appropriate, the allegations of the defendant. However, in this context the restriction applies that if the defendant disputes the assertions of the claimant, the court need not give the opportunity to provide evidence in the context of determining its jurisdiction. The investigation into jurisdiction on the basis of EU law instruments may therefore not be based solely on the basis chosen by the claimant for its claim.35.7.The standard set out above also applies if the Dutch court, in the context of the application of examines the general rules for international jurisdiction, as laid down in Rv, whether it has jurisdiction.4Facebook Netherlands5.8. With regard to Facebook Netherlands, the Dutch court has jurisdiction on the basis of the main rule of Article 2 DCCP, at least on the basis of Article 4 paragraph 1 Brussels Ia Regulation. After all, Facebook Netherlands is based in Amsterdam and therefore has its residence in Amsterdam. 5.9. Insofar as Facebook et al. argue that the Dutch court has no jurisdiction with regard to Facebook Netherlands - on the ground that Facebook Netherlands is not a controller or contracting party for Facebook users in the Netherlands, so that Facebook Netherlands is not a relevant party in this dispute - the court disregarded this argument. The involvement and responsibility of Facebook Netherlands with regard to the question of liability and its assessment (if necessary) are discussed in the main issue. Facebook Ireland and Facebook Inc.5.10.The dispute between the Foundation and Facebook Ireland falls substantively, formally and temporally within the scope of the Brussels Ia Regulation (after all, it concerns a commercial case brought after 10 January 2015 against a defendant with a place of residence in the European Union). This means that the question of whether the Dutch court has jurisdiction over Facebook Ireland must be answered on the basis of that regulation.5.11.Facebook Inc. is established in the United States and in the present case no treaty is applicable between the Netherlands and the United States regarding the jurisdiction of the Dutch court. The question whether the Dutch court with regard to Facebook Inc. has jurisdiction, must therefore be answered on the basis of general international jurisdiction law, as laid down in Rv. 5.12. The Foundation argues that the Dutch court has jurisdiction:- in respect of Facebook Ireland: primarily on the basis of Article 8, opening words and point 1, Brussels I bis Regulation, alternatively on the basis of Article 7, opening words and point 2, Brussels Ia Regulation; - with regard to Facebook Inc.: primarily on the basis of Article 7 paragraph 1 Rv, alternatively on the basis of Article 6 under e Rv. 5.13. The grounds put forward by the Foundation for jurisdiction with regard to Facebook Inc. (on the basis of Rv) correspond in substance to the grounds put forward for jurisdiction with regard to Facebook Ireland (on the basis of the Brussels I bis Regulation). The jurisdiction rules of Articles 7, paragraph 1 and 6 under e DCCP are derived to a large extent from the (precursors of) the current corresponding provisions in Article 8, opening words and point 1, respectively, Article 7, opening words and point 2, Brussels I bis. Regulation. When interpreting the articles of the Brussels Ia Regulation, the case law of the ECJ serves as a guideline. Now that the Dutch legislator has intended with the aforementioned provisions in the Rv to align with the provisions of (the predecessor of) the Brussels I bis Regulation, the court will also apply the case law of the ECJ to the interpretation and application of the aforementioned articles from the Rv. take guideline. 5.14. The foregoing results in the court having jurisdiction over Facebook Ireland and Facebook Inc. will assess jointly, now that the assessment framework for this is essentially the same. 5.15. Notwithstanding the main rule that the defendant is sued in the courts of the country where the defendant is domiciled, the Brussels I bis Regulation and Rv provide some special jurisdiction rules that lead to alternative grounds of jurisdiction. These are based on the close link between the court and the claim or the need to facilitate the proper administration of justice. The existence of a close relationship should ensure legal certainty and avoid the possibility of the defendant being sued in a court of a Member State which he could not reasonably have foreseen, according to recital 16 to the Brussels Ia Regulation. The special jurisdiction rules must be interpreted restrictively.5 That interpretation may only extend to the cases expressly referred to in that regulation.6- related claims?5.16.The Foundation states primarily that there are related claims, referring to Facebook Nederland as 'anchor defendant '. 5.17. The special jurisdiction rule of Article 8, opening words and point 1, of the Brussels Ia Regulation, reads, in so far as relevant here: A person domiciled in the territory of a Member State may also be sued: if there is more than one defendant: in the courts for the place of residence of one of them, provided that the claims are so closely connected that due process requires their simultaneous hearing and adjudication, in order to avoid that separate adjudication of the cases are given irreconcilable decisions.5.18.It follows from the case-law of the ECJ that it is for the national court, taking into account all the necessary elements of the file, to assess whether the various claims brought before it are coherent and thus whether there are any there is a risk of irreconcilable decisions in case of separate adjudication. The danger of incompatible decisions should be understood as the danger of conflicting decisions. It may be important in this regard whether the defendants acted independently of each other. The legal basis of the claims is also important, whereby an identical legal basis is not an indispensable condition for the application of Article 8, opening words and point 1, Brussels Ia Regulation. Furthermore, decisions cannot already be considered contradictory within the meaning of Article 8, preamble and point 1, Brussels Ia Regulation on the basis of some divergence in the settlement of the dispute; it is required that this divergence arises in the context of the same situation, in fact and in law.75.19.If claims brought against the different defendants have different legal bases, that in itself does not preclude the application of Article 8 of Brussels I bis-Vo, provided that the defendants could foresee that they could be sued in the Member State where at least one of them was domiciled.85.20.It remains to be seen whether there is a sufficiently close connection between the Foundation's claims against Facebook Nederland and the claims of the Foundation Against Facebook Ireland and Facebook Inc. 5.21.The Foundation has filed similar claims against the three defendants. Essentially, all those claims are based on the accusation that Facebook et al. violated the privacy of Facebook users in the Netherlands by failing to properly inform those users about the way in which Facebook et al. has handled personal data and by sharing confidential personal data of the users without their consent. permission to share with third parties. The Foundation holds all three defendants (jointly) responsible for the alleged violations of privacy. To this end, the Foundation has argued that Facebook Ireland, Facebook Inc. and Facebook Netherlands together as the controller of personal data (in the sense of the former Wbp and now the AVG). Facebook et al. disputed that the three entities can be regarded as joint controllers and has taken the position that only Facebook Ireland is controller with regard to the provision of the Facebook service to users in Europe.5.22.The court finds that it appears from the substantiation provided by the Foundation that the basis of the claims against the three defendants is essentially the same. It is not necessary to prejudge the assessment of the merits of that basis in the context of this incident. The substantive question of who is responsible for the processing is mainly discussed. The fact that the three defendants are different entities within the Facebook group and that the activities of those entities are different from each other does not mean that there are relevant differences in the factual and/or legal situation in this case. It is undisputed that the companies within the Facebook group are part of one and the same financial and operational business unit and that the group states all turnover worldwide as turnover of Facebook Inc. The business model of the Facebook group is based on income from (personalized) advertisements. The personal data that the Facebook group has obtained from its users play an (essential) role in the sale of those advertisements. With its activities, Facebook Netherlands makes a relevant contribution to advertising sales in the Netherlands and thus also makes a significant contribution to making the Facebook service profitable in the Netherlands. To that extent, the activities of Facebook Netherlands form an essential part of the activities of the Facebook group in the Netherlands. In addition, it is undisputed that, in order to carry out its activities, Facebook Netherlands has access to personal data of users of the Facebook service and that Facebook Netherlands has entered into a processor agreement with Facebook Ireland under which the former may use data provided by Facebook Ireland. for the provision of ancillary services of marketing, advertising and sales activities. 5.23. In view of the foregoing, the court is of the opinion that there is such a close connection between the identical claims against the three defendants that they should be dealt with simultaneously. It does not matter whether or not Facebook Nederland offers the Facebook service in the Netherlands and whether it processes personal data in that context.5.24.The court adds that, even in the event that there is no identical basis of the claims, it was also foreseeable for Facebook Ireland and Facebook Inc. that they could be sued in a Dutch court in a dispute about an alleged infringement of the privacy rights of Dutch users of the Facebook service. After all, Facebook Netherlands advises on the sale of advertisements aimed at users of the Facebook service in the Netherlands, while Facebook Ireland, according to Facebook et al. offers the Facebook service to users in the Netherlands. The fact that Facebook Inc. In this way, partly through its subsidiaries Facebook Netherlands and Facebook Ireland, it focuses directly on the Dutch market, this means that there is foreseeability as referred to above.5.25.Facebook et al. has further argued that the Foundation abuses the rules of jurisdiction by artificially introducing Facebook Netherlands involve the proceedings as an irrelevant anchor defendant in order to remove the case from the jurisdiction of the appropriate court. The court rejects this position. As considered above, there is sufficient correlation between the claims. This does not constitute abuse. It has also not become apparent that the Foundation has also brought the claims against Facebook Netherlands with the sole aim of getting Facebook Ireland and Facebook Inc. to be removed from the courts of their place of residence. In any event, at this stage of the proceedings it is not possible to conclude in advance that the basis laid down by the Foundation towards Facebook Nederland has no chance of success in advance. Facebook et al. have not provided sufficient leads to be able to rule that the jurisdiction regulation of Article 8 under 1 of the Brussels I bis Regulation should be disapplied on account of abuse. 5.26. The conclusion is that with regard to Facebook Ireland and Facebook Inc. the Dutch court can derive jurisdiction from Article 8, opening words and point 1, Brussels I bis Regulation and Article 7, paragraph 1 DCCP, respectively - place of the harmful event5.27.Although it has already been ruled that the court is competent to take cognizance of the claims against Facebook Ireland and Facebook Inc. Due to the close connection with the claims against Facebook Netherlands, the court will also rule on the subsidiary basis for jurisdiction relied on by the Foundation, since that basis has also been the subject of extensive debate between the parties.5.28.Article 7, preamble and under point 2, Brussels Ia Regulation provides that in matters relating to tort, delict or quasi-delict, the courts for the place where the harmful event occurred or may occur. Article 6 under e DCCP provides, in a similar sense, that the Dutch court has jurisdiction in cases concerning obligations arising from tort, delict or quasi-delict, if the harmful event has occurred or may occur in the Netherlands.5.29.It is settled case law of the ECJ that Article 7, preamble and item 2 of the Brussels I bis Regulation relates to both the place where the event that caused the damage occurred ('Handlungsort') and the place where the damage occurred ('Erfolgsort'). 9 This special jurisdiction rule must be interpreted independently and strictly.10 It is based (as stated) on the existence of a particularly close link between the claim and the courts of the place where the harmful event occurred or may occur, so that it from the point of view of proper administration of justice and a useful process organization, it is justified that these courts have jurisdiction. 115.30. The place of occurrence of the damage is d the place where the alleged damage actually occurs.12 The term “place where the harmful event occurred” cannot be interpreted so broadly as to include any place where the harmful effects can be felt of an event where damage has actually occurred elsewhere 135.31.The Foundation's claims in the main action relate to alleged wrongful acts, unfair commercial practices and unjust enrichment by Facebook et al. These claims therefore relate to tortious obligations as referred to in Article 7, opening words and point 2, Brussels I bis-Vo. 5.32.The acts and omissions blamed on Facebook et al. constitute a violation of privacy rights. The 'Erfolgsort' of the alleged damage of the persons for whom the Foundation claims to stand up, namely former and current users of the Facebook service in the Netherlands, is located in the Netherlands. After all, the damage, consisting of the loss of control over personal data, is experienced in the Netherlands. Also relevant in this regard is the judgment of the ECJ of 25 October 201114. It follows from this that in the event of an alleged violation of personality rights by content placed on the internet, the 'Erfolgsort' is located in the country of the user where he has the center of his interests. A comparable situation is the violation of the privacy rights of the user of an internet service, such as Facebook. It can be assumed that the users of the Facebook service for whom the Foundation claims to stand up for, have the center of their interests in the Netherlands.5.33.Facebook et al. has argued that the Foundation cannot invoke the 'Erfolgsort' of the persons for whom it claims to represent, because the Foundation is acting as the claimant in these proceedings and the Foundation itself does not suffer or has suffered any damage as a result of the alleged unlawful act. The court does not follow Facebook et al. in this argument. Neither the Brussels I bis Regulation nor the case law supports the view that a collective claim organization as referred to in Article 3:305a of the Dutch Civil Code (old) cannot appeal to the 'Erfolgsort' of its statutory supporters. The judgment of the Supreme Court of 14 June 2019 on VEB/BP15 or the conclusion of 17 December 2020 of the Advocate General (A-G) at the ECJ16, to which Facebook referred at the hearing, do not provide any basis for this. That case concerned claims by a collective claims organization for compensation for purely financial loss suffered by securities holders (financial loss). The considerations of the Supreme Court, the conclusion of the AG and the ECJ (in the judgment that has since been rendered17) focus on the question of where the 'Erfolgsort' should be located in that case, but as such do not cast doubt on the fact that a collective claim organization has the choice between 'Handlungsort' and 'Erfolgsort', if those places are located in different jurisdictions. 5.34. The bundling of interests by the Foundation as in this dispute also does not create a jurisdiction of the requested court that would not exist without such a bundling, now that in this case the 'Erfolgsort' of the individual members of the constituency always resides in the Netherlands. is located. There is no longer any discussion between the parties that an individual person concerned could litigate in the Netherlands. 5.35. With regard to Facebook Ireland and Facebook Inc. the Dutch court can therefore also derive jurisdiction from Article 7, preamble and point 2 of the Brussels I bis Regulation and Article 6(e) Rv.Periode from 25 May 20185.36. With regard to the period from 25 May 2018, the parties are in the first do not even mention the relationship between the jurisdiction rules laid down in the Brussels I bis Regulation and the Code of Civil Procedure (Rv) on the one hand and the jurisdiction rules laid down in the GDPR on the other. 5.37.Facebook et al. has argued in this regard that the claims brought by the Foundation that arose on or after 25 May 2018 are based on the GDPR. Facebook et al. argue that the GDPR is a lex specialis for disputes in the field of data protection and that the GDPR therefore has its own (international) jurisdiction rules for legal claims based on the GDPR. These jurisdiction rules replace the jurisdiction rules of the Brussels I bis Regulation and Rv. Insofar as the Foundation's claims relate to claims under the GDPR, the court must therefore assess its jurisdiction solely against the GDPR, according to Facebook et al.5.38. The court first states that both the Brussels I bis Regulation and the GDPR have direct effect. in the Member States. 5.39.Article 67 of the Brussels Ia Regulation reads, in so far as relevant here, as follows: This Regulation shall not affect the application of the provisions governing jurisdiction in particular matters and which are or will be included in the decisions of the Union (...). 5.40.Article 79(2) of the GDPR reads as follows: Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Such proceedings may also be brought before the courts of the Member State where the data subject habitually resides, unless the controller or processor is a public authority of a Member State acting in the exercise of public authority.5.41.In recital 147 to the GDPR states the following regarding the relationship between the GDPR and the Brussels Ia Regulation: Where this Regulation provides for specific rules of jurisdiction, in particular with regard to proceedings seeking a remedy, including compensation, against a controller or processor, general jurisdictional rules, such as those of Regulation (EU) No 1215/2012 of the European Parliament and of the Council, are without prejudice to the application of those specific rules.5.42.The Foundation's claims in the main action are based on unlawful acts by Facebook cs that the Foundation qualifies as tort, unfair trade practices and unjust enrichment. In view of the general nature and, in principle, the wide material scope of the jurisdiction regime laid down in the Brussels Ia Regulation, it can only be assumed that the EU legislature intended to adopt a jurisdiction regime deviating from that regulation (not supplementary but) applicable exclusively if that is sufficiently clearly expressed in the relevant regulation. It does not follow from the text of the AVG, nor from the preamble that for a claim in tort, even if the alleged unlawful act relates to the processing of personal data, the jurisdiction regulation in Article 79 paragraph 2 GDPR is an exclusive regulation that the Brussels Ia Regulation set aside. It follows from the preamble under 147 that the general jurisdictional rules of the Brussels Ia Regulation may not prejudice the application of the specific jurisdictional rules contained in the GDPR. This simply means that in a situation where both the Brussels Ia Regulation and the GDPR apply, the Brussels Ia Regulation cannot deprive a power designated by the GDPR. The GDPR thus supplements the general jurisdiction rules of the Brussels I bis Regulation to that extent. 5.43. Testing against the Brussels I bis Regulation and Rv results in the Dutch court having jurisdiction. In that case, the same grounds for jurisdiction apply as the grounds adopted by the District Court for the claims relating to the period prior to 25 May 2018. Reference is made to the judgment given in considerations 5.4 to 5.35 inclusive.5.44. Incidentally, the District Court is is of the opinion that when (also) an assessment is made against Article 79, paragraph 2 of the GDPR, as has been argued by Facebook et al., this does not lead to a different outcome when it comes to the jurisdiction of the Dutch court. The following is the reason for this. 5.45.Article 79(2) of the GDPR only provides a jurisdiction for a procedure to be instituted against a controller or processor. It is not in dispute that (in any event) Facebook Ireland is the data controller with regard to the processing of the personal data at issue in this proceeding. The question then is, in view of Article 79, paragraph 2, first sentence of the GDPR, whether Facebook Netherlands can be regarded as an establishment of Facebook Ireland. After all, if that is the case, the Dutch court has jurisdiction. For the explanation of the concept of establishment in the GDPR, the case law of the ECJ on the concept of establishment in the Privacy Directive, the predecessor of the GDPR, is important. The court is of the opinion that Facebook Netherlands can be regarded as an establishment of Facebook Ireland. For the reasoning of this, reference is made for the sake of brevity to considerations 8.6 to 8.12 inclusive, since that is where the concept of establishment is discussed. In addition, the Dutch court can also derive jurisdiction in these proceedings with regard to Facebook Ireland from Article 79, paragraph 2, second sentence, of the GDPR. That second sentence offers the possibility of also bringing the proceedings before the courts of the Member State where the person concerned habitually resides. In this case, the data subjects whose personal data has been processed reside in the Netherlands. The Court does not agree that the Foundation as a representative cannot rely on the whereabouts of the data subjects, as has been argued by Facebook et al., since Article 80 of the GDPR expressly offers the possibility of advocacy and states that the representative can exercise the rights of the data subjects. without making a distinction between procedural and substantive rights. The comparison made by Facebook et al. with Article 18 of the Brussels I bis Regulation and the judgment [party]18 does not hold in this case, because the Foundation does not litigate on the basis of power of attorney or assignment, but on the basis of Article 3:305a of the Dutch Civil Code (old ). The foregoing means that both the first sentence and the second sentence of Article 79 paragraph 2 AVG (also) create jurisdiction for the Dutch court with regard to Facebook Ireland.5.46. With regard to Facebook Netherlands and Facebook Inc. Facebook et al. has argued, the court understands, that Article 79, paragraph 2 of the GDPR precludes proceedings being instituted against them because they are not controllers or processors within the meaning of the GDPR. The parties differ on whether Facebook Nederland and Facebook Inc. be designated as such. Whether they are controllers and/or processors within the meaning of the GDPR can be left open in the context of this incident. Even if that is not the case, Article 79 paragraph 2 does not apply with regard to Facebook Netherlands and Facebook Inc. but it is possible to fall back on the jurisdiction regulation in the Brussels I bis Regulation and Rv. Neither the EU law nor the case law of the ECJ supports the position of Facebook et al., which means that conducting data protection proceedings against a party other than a controller or processor should lead to a lack of jurisdiction on the part of the court seised. . Conclusion5.47.The conclusion is that this court has jurisdiction to hear the dispute against all three defendants. The cross-appeal claim for incompetence must therefore be dismissed.6 The assessment in the incident to arrest6.1.Facebook et al. initially demanded that these proceedings be suspended because of proceedings that had previously been instituted in Belgium in which, according to Facebook et al., related claims are at issue. At the hearing, Facebook et al. changed its position. She now requests that the court stay the proceedings pending the answer by the ECJ to preliminary questions submitted on 28 May 2020 by the Bundesgerichtshof in Germany and on 25 November 2020 by the Oberster Gerichtshof in Austria19. According to Facebook et al., these preliminary questions raise the question of whether Article 80 GDPR precludes rules of national law that give associations, foundations and other entities the power to initiate proceedings in civil courts for alleged violations of the GDPR. on the basis of the prohibition of unfair commercial practices, violations of consumer law or the prohibition of the use of invalid terms and conditions, independently of the specific violation of the rights of individual data subjects and without having been instructed to do so by the data subject. As a result, those preliminary questions and the decision of the ECJ on them are of direct importance for the present proceedings, according to Facebook. 6.2. The Foundation opposes adjournment of the case. 6.3. The court sees insufficient reason in the preliminary questions referred to by Facebook et al. to stay these proceedings. On the basis of the decisions of the German and Austrian courts, it can be established that the claims in those proceedings are of a different nature from the claims brought by the Foundation in these proceedings and that the claimants are also a different type of organization from the Foundation as a collective action foundation. The claims brought in the German and Austrian proceedings were more in the nature of what could be characterized as a public interest action under Dutch law. The question has been raised by the German and Austrian courts as to how the claims brought in civil courts relate to the enforcement and supervisory powers of the national supervisory authority. In view of the differences referred to above, Facebook et al. have insufficiently substantiated that the questions referred for a preliminary ruling may be relevant for the assessment in this case. Contrary to what Facebook et al. has argued, there is no ground for the opinion that the claims brought by the Foundation cannot and must be brought before a civil court but only before the AP as a supervisory authority. 6.4. The incidental claim for arrest will be rejected. 7 The assessment in the incident of inadmissibility 7.1. Facebook et al. claim that the court declares the Foundation inadmissible because, in short, the Foundation does not meet the requirements that apply to a collective action organization. 7.2.The question of whether the Foundation is admissible as a collective action organization must – irrespective of the law applicable to the claims of the Foundation – be answered in accordance with Article 10:3 of the Dutch Civil Code. Below, the court will first consider the admissibility criteria of Section 3:305a of the Dutch Civil Code (old). The meaning of Article 80 of the GDPR for the admissibility question will then be discussed. 7.3. In its assessment, the court will base its assessment on the purpose description and definitions described in the Foundation's articles of association, as well as on the subpoena issued by the court in marginal 10. The Foundation has given a description of the constituents whose interests it represents in these proceedings. Assessment framework 7.4. With effect from 1 January 2020, the Act on the Settlement of Mass Damage in Class Action (WAMCA) came into effect. However, in view of Article 119a of the Transitional Act of the new Civil Code in conjunction with Article III paragraph 2 of the WAMCA, the WAMCA does not apply to this case, because the legal actions in this case were instituted before the WAMCA came into effect. The Collective Settlement Mass Claims Act (WCAM) applies, as laid down in, among other things, Section 3:305a of the Dutch Civil Code, as this provision applied until 1 January 2020. ) a foundation can institute legal proceedings aimed at protecting similar interests of other persons ('the similarity requirement'), insofar as it represents these interests pursuant to its articles of association ('the articles of association requirement'). Paragraph 2 provides that a legal person as referred to in paragraph 1 is inadmissible if, in the given circumstances, it has made insufficient efforts to achieve the claim through consultation with the defendant. On the basis of paragraph 2, inadmissibility also applies if the legal claim does not sufficiently safeguard the interests of the persons for whom the legal claim has been instituted. Paragraph 3 provides that the claim cannot serve as compensation in money. 7.6. The Foundation has the obligation to provide information and, in the event of a dispute, the burden of proof with regard to the requirements referred to in Article 3:305a paragraph 1 of the Dutch Civil Code (old). After all, those are the two conditions for a collective action organization to be able to institute legal proceedings. In contrast, Facebook et al. in principle have the obligation to state and prove that there is a situation as referred to in Section 3:305a(2) of the Dutch Civil Code (old). After all, these situations constitute an exception to paragraph 1 and Facebook et al. invoke their existence. 7.7. It is not in dispute that the Foundation complies with the Articles of Association requirement. The parties disagree on whether the requirement of similarity has been met and whether one of the situations described in paragraph 2 occurs. The requirement of similarity 7.8. The first question is whether the requirement that the claims instituted by the Foundation 'are intended to protect similar interests of other persons' as referred to in Section 3:305a of the Dutch Civil Code (old). That requirement is met if the interests which are the subject of legal claims lend themselves to bundling, so that efficient and effective legal protection for the benefit of the interested parties can be promoted. After all, in one procedure it is possible to adjudicate on the points of dispute and claims raised by the legal action, without the special circumstances on the part of the individual interested parties having to be taken into account.20 Sufficient similarity of interests need not imply that the positions, backgrounds and interests of those on whose behalf a collective action is instituted are identical or even predominantly the same. A certain abstract assessment is therefore appropriate in a collective action.217.9.According to Facebook et al., the Foundation's claims do not lend themselves to collective treatment, because the questions of fact and questions of law are not the same, or at least not sufficiently similar, and the interests of individual stakeholders differ. To that end, Facebook, in summary, argues the following. There are various factual allegations spanning almost a decade. There are also different groups of users and different legal provisions apply. The summons mentions seven incidents, each of which must be regarded as an isolated event. It is not possible to group these incidents under a single heading. Furthermore, the Facebook service has a unique and individualized character. The use of the Facebook service involves a considerable degree of sophistication on an individual level. Users are subject to different user agreements, policies and disclosures, depending on the period of time in which each of them has used the Facebook service. An individual user may also have made use of the different types of features, settings and controls visible to them on the platform in different ways. The basis for data processing has varied over time. The question of whether and, if so, to what extent an individual has been affected can ultimately only be answered by examining, on an individual level, how each individual has used the Facebook service at different times over the past decade, according to Facebook cs7.10. In response to the argument of Facebook et al., the Foundation put forward that the privacy violations were committed without regard to persons and that the manner in which information was provided and (deficient) consent was obtained in a uniform and standardized manner. In time, this procedure was always the same for all users of the Facebook service and individual aspects played no role. Facebook et al. made no distinction between (groups of) users and the way in which they were informed. According to the Foundation, at no time in the relevant period between 2010 and 2020 and in any set of terms of use were the users of the Facebook service properly informed about the use and processing of their personal data. There have therefore been various generic violations of privacy by Facebook et al. Furthermore, according to the Foundation, it is irrelevant for the assessment of the claims which data an individual user has provided and whether one user has shared more personal data with Facebook et al. than another user. Apart from the data that the user has shared himself, Facebook et al. has also unlawfully obtained and processed data from users, according to the Foundation.7.11. The court considers as follows. The question of whether the interests involved in the claims lend themselves to bundling depends in part on the nature of the claims brought. The Foundation's claims are limited to declaratory judgments alleging unlawful acts, unfair commercial practices and unjust enrichment. Contrary to some of the judgments to which Facebook et al. referred, the Foundation does not, for example, claim a declaration of law in connection with error, in the assessment of which individual circumstances are more important. 7.12.The Foundation's claims relate to various sufficiently narrowly defined actions by Facebook et al. Those claims are based in essence on the fact that Facebook et al. has violated the privacy of its users (insofar as they belong to the following) because they consent to have processed personal data. With the submitted claims, the Foundation thus wishes to obtain an opinion on whether personal data of (certain) users of the Facebook service have been processed in accordance with the regulations. Such an opinion about the (un)lawfulness of the conduct of Facebook et al. with regard to the processing of personal data lends itself to a collective action. This does not alter the fact that over time there have been different user conditions and different legal regulations. After all, if necessary, this can be taken into account in the assessment in the main proceedings. The question of whether the conduct of Facebook et al. is (un)lawful can be further answered without taking into account the special circumstances on the part of the individual stakeholders. After all, questions about damage or a causal relationship are not yet addressed in these proceedings and on the basis of the basis put forward by the Foundation, it is not important for the assessment of its claims which and how much data an individual user has provided to Facebook et al. 7.13. to the extent that the Foundation requests an opinion on one or more specific events, the related claims can also be bundled. Here too, the first question that arises is whether the event in question has occurred and whether the conduct of Facebook et al. is (un)lawful. In this collective procedure it is not yet necessary to determine which individual stakeholders may have been affected. It is sufficient that on the basis of the court's judgment a member of the constituency can determine whether he has been affected by a possible violation of privacy. It must be possible to establish this on the basis of the claims formulated by the Foundation, now that the assessment by the court can, if necessary, be differentiated according to, for example, statutory regulation, time period and/or event. 7.14. The position of Facebook et al. that it is very likely that a large part of the alleged claims is time-barred does not preclude the similarity of the interests involved in the claims. Assessment of a possible appeal to prescription is the main issue, insofar as this defense relates to distinguishable categories of users. Facebook et al. has insufficiently substantiated that in this case an investigation at the level of the individual user is required for the assessment of a possible appeal to limitation, now that Facebook et al. only referred to the elapsed time since 2010.7.15.The foregoing means that the claims brought by the Foundation are intended to protect similar interests of other persons. In principle, these claims lend themselves to bundling in a collective action. 7.16. Specifically with regard to the claimed declaratory judgment that there is unjust enrichment, Facebook et al. have further argued that such a claim necessarily requires an assessment at an individual level. The court considers that, in general, when assessing an appeal to unjust enrichment, in principle individual circumstances are taken into account. In this case, however, the Foundation substantiated that the degree of enrichment and the degree of impoverishment, as well as the causal relationship between them, is conceptually the same with regard to all stakeholders, because the impoverishment consists of the injured parties (unknowingly) taking control of the have lost their personal data, while Facebook et al. has been (unjustifiably) enriched because it (in violation of the privacy rules) obtained access to that personal data and was able to use that personal data for its revenue model. In the opinion of the court, the correctness of this statement of the Foundation can be answered without a review of individual circumstances. It is also important that the extent of the enrichment in the context of this collective procedure does not yet require an answer, but that it must only be assessed whether there is unjust enrichment. Decisive for the answer to that question is, in particular, whether the processing (and further use) of personal data was permitted and whether those personal data represented a value. These are questions that in this case can be abstracted from individual circumstances. 7.17. The court therefore concludes that the Foundation's claims relate to interests that can be sufficiently generalized and that can be counted among the similar interests as referred to in Section 3:305a of the Dutch Civil Code.7.18. Contrary to what Facebook et al has argued, bundling promotes of the interests of the supporters of the Foundation also an efficient and effective legal protection. After all, the general question as to the unlawfulness of the alleged conduct and the liability of Facebook et al. can be answered in these collective proceedings. This makes this collective procedure more efficient than conducting individual proceedings about the lawfulness of the data processing by Facebook et al. It is also clear that the individual stakeholders for whom the Foundation stands up undeniably benefit from granting the declaratory judgments claimed by the Foundation. . The foregoing does not alter the fact that an individual interested party cannot simply claim compensation on the basis of a possible allocation of the claimed declaratory decisions in this collective action and that an (individual) follow-up procedure may be necessary for this. The comparison made by Facebook et al. with the judgment in the case of Stichting Elco against Rabobank et al.22 does not hold. In that case, it was not possible to abstract from the individual circumstances of each of the possible injured parties when assessing the unlawfulness judgment. When assessing the legality or illegality of the privacy violations alleged by the Foundation, it is possible to abstract from the individual circumstances. The court therefore concludes that the bundling in this case has added value from the point of view of efficient administration of justice. Insufficient consultation held?7.19.Facebook et al. stated that the Foundation failed to conduct reasonable consultations before filing the claims. According to Facebook et al., the Foundation was not prepared to conduct constructive consultations before starting a procedure, but the Foundation was aimed at leaving the consultation phase behind as soon as possible and starting this procedure before the WAMCA came into effect. On the other hand, according to Facebook et al., Facebook Ireland has shown its willingness to consult by immediately requesting the additional information from the Foundation that was necessary for proper consultation and by indicating that it was prepared to make an appointment at the beginning of 2020 to to consult with the Foundation. 7.20. Pursuant to Article 3:305a paragraph 2, first sentence, of the Dutch Civil Code (old), a party that commences a class action is inadmissible if, in the given circumstances, this party has not sufficiently attempted to meet the claim by consulting with the to reach the defendant. A term of two weeks after receipt by the defendant of a request for consultation, stating the claim, is in any case sufficient according to the second sentence of paragraph 2. 7.21. It follows from the legislative history that the purpose of consultation is, in short, to prevent a defendant from being summoned raucously and to encourage the parties to come to a solution themselves. The term that the Foundation has offered to Facebook et al. in its letter of 19 November 2019 meets the legal minimum. Moreover, unlike Facebook et al. asserts, Facebook Ireland's response does not contain a clear statement of willingness to enter into consultations. It states that Facebook Ireland first wants to receive additional information before considering the Foundation's invitation. Furthermore, it has not been shown that Facebook et al.'s interests were harmed by the – albeit short, but meeting the legal minimum – period between the letter from the Foundation of 19 November 2019 and the summons of 30 December 2019. It may also be pointed out here. that the Foundation has opted to serve a summons in a broad period of time (by 6 May 2020), whereby Facebook et al. were again given the opportunity to enter into consultations in the intervening period of five months. 7.22. In view of the foregoing, the court therefore sees no grounds for the conclusion that the Foundation has not sufficiently attempted to achieve the claim through consultations in the given circumstances. Interests of supporters insufficiently safeguarded?7.23.The question of whether the interests of the persons for whom the legal action has been instituted are sufficiently safeguarded must be answered on the basis of the concrete circumstances of the case. According to the legislative history23, in the event of a dispute, two central questions must be answered: to what extent do the parties ultimately benefit from the collective action if the claim is awarded, and to what extent can it be trusted that the applicant organization has sufficient knowledge and skills? to conduct the procedure. Viewpoints that can play a role in this regard include: what other activities has the organization performed to promote the interests of those involved and has the organization been able to achieve objectives in the past, if of an ad-hoc organization, is it established by an already existing organization that has successfully represented the interests of those involved in the past, how many injured parties are affiliated with the organization and to what extent do they support the collective action, and whether the organization complies with the principles from the Claim Code.7.24.From the law History follows that the background of the guarantee criterion is mainly inspired by the exclusion of incompetent organizations or organizations with motives that are purely commercially driven.24 Furthermore, it is not a requirement that the interest organization is sufficiently representative with regard to the interests of those who serve whose action has been instituted.257.25.Facebook et al. has taken the position that the Foundation does not sufficiently safeguard the interests of those for whom it claims to stand up. To this end, Facebook et al. argued, in summary, that the Foundation is an instrument of litigants, pursues its own financial interests, has no track record as representing the interests of third parties, has not demonstrated that it represents affiliated persons and does not meet the requirements of the Claim code. With regard to that Claim Code, Facebook et al. argue that the Foundation is not independent of its financier, that the members of the Board and the Supervisory Board of the Foundation have insufficient experience and expertise and that the Foundation does not operate without a profit motive. 7.26. The court considers as follows. The Foundation was set up especially for this collective action and in that sense an 'ad hoc organisation'. Article 3.3 of the articles of association stipulates that it is not for profit. The Foundation receives funding from a third party, the American law firm Lieff Cabraser, to conduct these proceedings. The fact that legal proceedings are financed by a third party in a collective procedure is generally accepted (which is also expressed in the Claim Code) and there is in itself no legally relevant objection to this. It is important, however, that the directors and members of the supervisory board of the interest group are independent of the external financier (principle III of the Claim Code). The Foundation has stated that this is the case, referring not only to the background of its three directors and three members of the supervisory board, but also to the agreements made with the litigation funder. The Foundation has explained about this cooperation that it has entered into an arm's-length agreement with Lieff Cabraser, in which the independence and independence of the Foundation are anchored, and that agreement stipulates that only the Foundation, together with its lawyers, is responsible for the process strategy and determines the settlement strategy and that the Foundation only obtains advice from Lieff Cabraser. The financier cannot or may not exercise decisive influence on the procedural documents. The Foundation's lawyers are also independent of the financier; they act solely on the instructions of the Foundation's board. In response to the explanation provided by the Foundation, Facebook has not put forward any concrete information on the basis of which doubts should be cast as to the independence of the Foundation vis-à-vis the litigant financier. The court therefore ignores Facebook's unsubstantiated claim that the Foundation is an instrument of the litigation financier. The Foundation has explained that Lieff Cabraser will receive compensation of a maximum of 18% plus costs, subject to court approval, if the Foundation obtains compensation for injured parties. It has not been shown that the fee for the litigation financier falls outside the range of what is customary and - from the point of view of independence - acceptable.7.27.The Foundation has further stated that it has expert directors and members of the supervisory board who have extensive experience and have expertise in areas such as (collective) advocacy. In support of this, the Foundation has outlined the career and background of its directors and supervisors on the basis of the CVs submitted and also published on the Foundation's website. In the opinion of the court, the information about the background of these persons sufficiently demonstrates that the directors and members of the Supervisory Board of the Foundation have the necessary experience and expertise. The Foundation has also provided insight into the remuneration of its directors and members of the Supervisory Board. It is undisputed that the remuneration is in line with the market. In the light of the foregoing, Facebook et al. has insufficiently substantiated that the Foundation does not comply with the Claim Code or that the Foundation is pursuing its own financial interests. 7.28. It is also established that the Foundation cooperates with the Consumers' Association, a non-profit interest organization that has been defending the interests of consumers in the Netherlands for many years and that supports collective action. The fact that there is also sufficient support among the supporters for conducting this procedure is also apparent from the number of statements of support (more than 183 thousand as of 25 November 2020) that the Consumers' Association and the Foundation have received from July 2020.7.29. considers that the parties concerned ultimately benefit from this collective action if the claim is awarded and that the Foundation can be relied upon to have sufficient knowledge and skills to conduct this procedure. Facebook et al. have provided insufficient concrete information that would require a different opinion. There is therefore no ground for the opinion that the interests of the persons for whom the legal claims have been instituted are insufficiently safeguarded.Article 80 of the AVG7.30.Facebook et al. has argued that the Foundation does not comply with the (additional) admissibility requirements of Article 80 GDPR with regard to claims relating to the period from 25 May 2018. For example, the Foundation does not qualify as a non-profit organisation, the Foundation is not active in the field of data protection and the Foundation has not been commissioned by the data subjects to initiate this procedure, according to Facebook cs7.31. Article 80 GDPR reads as follows: 1. The data subject shall have the right to a non-profit making body, organization or association duly constituted under the law of a Member State, whose statutory objectives serve the public interest and which is active in the field of data protection to instruct the data subject's rights and freedoms in relation to the protection of his or her personal data, to make the complaint on his behalf, to exercise on his behalf the rights referred to in Articles 77, 78 and 79 and, on his behalf, to exercise the right referred to in Article 82 to exercise compensation, if provided for by Member State law. 2. Member States may provide that a body, organization or association referred to in paragraph 1 of this Article has the right to lodge a complaint in that Member State with the competent supervisory authority in accordance with Article 77, independently of the mandate of a data subject, and to exercise the rights referred to in Articles 78 and 79, if it considers that the rights of a data subject under this Regulation have been infringed as a result of the processing.7.32.The court considers that the rights referred to in Article 80 GDPR The enforcement options laid down must be exercised through national (procedural) law. Pursuant to Article 80(2) of the GDPR, the Union legislator has left it to the Member States to determine whether the organizations referred to in Article 80(1) of the GDPR also have their own right, which is independent of an assignment from the data subject, to exercise the options provided for in Articles 77. , 78 and 79 GDPR. Pursuant to Section 3:305a of the Dutch Civil Code (old), no instruction from the person concerned is required. Contrary to what Facebook et al. has argued, the GDPR does not require the Foundation to have an assignment from the data subjects in these proceedings (in which only declarations of justice are claimed, and no compensation). 7.33. When it comes to the question of whether the Foundation complies with the definition given in Article 80(1) of the GDPR, it is disputed between the parties whether the Foundation operates on a non-profit basis and whether it is active in the field of data protection. On the basis of Article 3.3 of the Foundation's articles of association and what has been further considered in recitals 7.26 - 7.27, it can be assumed that the Foundation is a non-profit organisation. Being active in the field of data protection as referred to in Article 80 of the GDPR does not require high requirements from the point of view of the effective exercise of enforcement options. Nor does it appear from the preamble to the GDPR that this concept should be interpreted restrictively. The Foundation was established in 2019 and its activities are currently mainly expressed in conducting this procedure. In addition, the Foundation has explained, the Foundation has a collaboration with the Consumers' Association, it consults with other interest groups and is publicized through the media. In view of this, the Foundation is actually developing activities and the requirement for the Foundation to be active in the field of data protection has been met. Conclusion7.34.Based on all of the foregoing, the court concludes that the Foundation is admissible in its collective action. The cross-appeal claim for inadmissibility is therefore rejected.8 The assessment of the applicable law8.1.The parties differ on the question of which law applies to the claims brought by the Foundation. They have asked the court to give an opinion on this already in this first phase of the procedure, prior to any substantive handling of the case. 8.2. In its assessment, the court will first consider the applicable privacy law and then the also applicable general tort law. This is because privacy law does not include the full substantive law for assessing the claims of the Foundation based on tort at issue here.8.3. According to the Foundation, the unlawful act and omission that the Foundation accuses Facebook et al. longer period, namely from April 1, 2010 to January 1, 2020. This affects the assessment framework. A distinction will therefore also be made below by period. The applicable privacy law Period 1 April 2010 to 25 May 2018 8.4. Insofar as the claims relate to the period before 25 May 2018, it is important that the Privacy Directive26 applied during that period. 8.5. Pursuant to Article 4(1)(a) of the Privacy Directive, each Member State applies its national provisions adopted pursuant to this Directive to the processing of personal data if it is carried out in the context of the activities of an establishment in the territory of the Member State of the controller. Where the same controller has an establishment in the territory of several Member States, the controller must take the necessary measures to ensure that each of those establishments complies with the obligations imposed by the applicable national law.8.6.Article 4(1) , preamble and under a, of the Privacy Directive makes it possible to apply the legislation on the protection of personal data of a Member State other than the one in which the person responsible for the processing of that data is registered. This requires that the controller, through a permanent establishment on the territory of that other Member State, carries out an activity in the context of which such processing takes place.278.7.According to the preamble under 19 to the Privacy Directive, an establishment as referred to in Article 4 of the the Privacy Directive the effective and effective performance of activities by a permanent establishment. The legal form of such an establishment, be it a branch or a subsidiary with legal personality, is not decisive in this regard. 8.8.It follows from the case law of the ECJ that the concept of establishment in Article 4 of the Privacy Directive must be interpreted flexibly. That concept covers any form of real and effective activity, even minor, which is carried on through a permanent establishment. In order to determine whether a company responsible for data processing has an establishment in a Member State other than the Member State or third country in which it is registered, both the degree of durability of the establishment and the actual that other state, taking into account the specific nature of the business and the service involved. This applies in particular to companies that offer their services exclusively via the Internet. Under certain circumstances, a single representative may already have a permanent establishment if that person acts with a sufficient degree of sustainability and with the help of the necessary resources for the provision of the relevant concrete services in the Member State concerned.288.9.Facebook Netherlands must, in view of the above explanation of the ECJ, are regarded as an establishment of Facebook Ireland and Facebook Inc. It is established that Facebook Netherlands has been providing marketing and sales support activities for the Facebook group for many years. Those activities are closely related to the services provided by Facebook et al., because it is not possible to offer the Facebook service without advertising sales and Facebook Nederland makes an important contribution to that advertising sales. This means that Facebook Netherlands carries out real and actual activities, as well as that action is taken with a sufficient degree of sustainability. The foregoing therefore does not alter the fact that, according to Facebook et al., this concerns 'supportive' activities and that Facebook Netherlands does not itself offer the Facebook service.8.10. It must then be assessed whether the processing of personal data takes place in the context of the activities of the establishment. 8.11.Article 4 of the Privacy Directive does not require that the processing of personal data concerned is carried out by the establishment concerned itself, but only that it is carried out in the context of its activities. The phrase “in the context of the activities of the establishment” should not be interpreted restrictively.29 In the case against Google Spain and Google, the ECJ ruled that there is processing of personal data in the context of the activities of an establishment of the controller on the territory of the Member State, within the meaning of Article 4 of the Privacy Directive, where the operator of a search engine in a Member State, for the purpose of promoting and selling advertising space offered by that search engine, has a branch or a subsidiary establishes its activities aimed at the residents of that Member State. In such circumstances, the activities of the operator of the search engine and those of its establishment established in the Member State concerned are inextricably linked, since the activities relating to advertising spaces constitute the means of making the search engine concerned economically viable and, at the same time, making that machine the is the means by which these activities can be performed.308.12.It is not in dispute that personal data of users of the Facebook service who are located in the Netherlands have been processed by Facebook et al. In view of what has been outlined by the Foundation, and insufficiently contradicted by Facebook et al. business model of Facebook et al., Facebook et al. generates the majority of its income from the sale of advertisements and in this way makes the Facebook service profitable, while at the same time that service is the means through which advertisement sales are possible. In view of this, the activities of Facebook Netherlands, which make a significant contribution to advertising sales, must be considered inseparable from the activities of Facebook Ireland and Facebook Inc. On that basis, it must be ruled that the processing of personal data of the users of the Facebook service for whom the Foundation stands up has (also) taken place in the context of the activities of Facebook Netherlands. The fact that, as Facebook et al. states, the users of the Facebook service in the Netherlands only enter into a contractual relationship with Facebook Ireland, is not decisive in this regard.8.13.The conclusion is that, on the basis of Article 4 of the Privacy Directive, Dutch law can be applied to the data processing at issue in this dispute. 8.14. It must be examined whether the Wbp is applicable on the basis of the territorial scope of Dutch legislation. Article 4 paragraph 1 Wbp provides that this law applies to the processing of personal data in the context of activities of an establishment of a controller in the Netherlands. The Wbp therefore applies, also taking into account that the aforementioned description must be interpreted in accordance with the Directive. 8.15. With regard to the discussion about the applicability of the Tw, this act is an implementation of the E-Privacy Directive31. This Directive does not contain a conflict of law rule for determining the applicability of national law. Regardless of whether Article 4 of the Privacy Directive should be considered (the position of Facebook et al.) or whether the controller addresses internet users in the Netherlands (the position of the Foundation), the result in both cases is that Article 11.7 a Tw applies. Period 25 May 2018 to 1 January 2020 8.16. It is not in dispute that insofar as the claims relate to the period from 25 May 2018 the GDPR applies. As a regulation, the GDPR has direct effect and the dispute falls within both the substantive and territorial scope as defined in Articles 2 and 3 GDPR. 8.17. The parties do not agree on which national implementing legislation applies. According to the Foundation, this is the Dutch Implementation Act of the General Data Protection Regulation (UAVG). According to Facebook et al., this is the Irish Data Protection Act 2018 (DPA 2018). 8.18.Although the parties have debated which national implementing legislation is relevant, it is not yet clear to the court whether the content of that legislation is relevant to the assessment of the main dispute, nor is it clear whether or not the Dutch and Irish implementing legislation differ on any points relevant to the dispute. If that legislation proves to be relevant, the following applies. 8.19. The court finds that the GDPR does not contain a conflict rule on the basis of which it can be determined which national implementing legislation applies to a dispute of an international character to which the GDPR (also) is concerned. applies to. Contrary to the parties' opinion, Article 3 of the GDPR cannot be regarded as such a conflict rule. This means that it is necessary to assess whether this legislation is applicable on the basis of the territorial scope of national legislation. 8.20. Pursuant to article 4 paragraph 1 UAVG, this law and the provisions based on it apply to the processing of personal data in the context of activities of an establishment of a controller or a processor in the Netherlands. This description is in line with the description in the GDPR and the Privacy Directive. In view of the case law of the ECJ, Facebook Netherlands must be regarded as an establishment of Facebook Ireland and Facebook Inc. (see what has been considered above about Article 4 of the Privacy Directive) and the UAVG can therefore be applied to this dispute. The applicable tort lawPeriod 1 January 2012 to 1 January 20208.21. The Rome II Regulation32 (hereinafter: Rome II) has been applicable since 11 January 2009, contains conflict of laws rules for non-contractual obligations and has a universal formal scope of application. However, in Article 1 paragraph 2, preamble and under g, of its scope, Rome II excludes, inter alia, non-contractual obligations arising from an infringement of privacy or of personality rights, including defamation. In view of the accusations made by the Foundation against Facebook et al., which qualify as an infringement of privacy and/or personality rights, Rome II is therefore not directly applicable.8.22. Pursuant to Article 10:159 of the Dutch Civil Code, which entered into force on 1 January 2012. nevertheless, the provisions of Rome II shall apply mutatis mutandis to obligations which fall outside the scope of Rome II and the applicable treaties and which may be classified as tort or delict. This means that the provisions of Rome II via Article 10:159 of the Dutch Civil Code apply mutatis mutandis to the (alleged) unlawful act and omission of Facebook et al., insofar as this occurred from 1 January 2012.8.23.Article 4 paragraph 1 Rome II means that, unless otherwise provided in the Regulation, the law applicable to a tort or delict is the law of the country in which the damage occurs, regardless of the country in which the event giving rise to the damage occurred and regardless of the countries in which the damage occurred. indirect consequences of that event. Article 4, paragraph 3, Rome II provides that, if it appears from all the circumstances that the tort or delict has a manifestly closer connection with a country other than the one referred to in paragraph 1, the law of that other country shall apply; an apparent closer link with another country could in particular be based on a pre-existing relationship between the parties closely related to the tort, such as an agreement.8.24.For the concept of 'the country where the damage occurs' of Article 4 paragraph 1 Rome II can be linked to the concept of 'place where the harmful event has occurred or may occur' as referred to in (the predecessor of) Article 7, opening words and under 2, of the Brussels I bis Regulation and the related case law of the ECJ.338.25. It is undisputed that the Netherlands is the country where the (alleged) damage of the Foundation's supporters occurs. Furthermore, it has not been argued or shown that the case here is that the wrongful act has a manifestly closer connection with another country. This means that, pursuant to the main rule of Article 4, paragraph 1, Rome II, in conjunction with Article 10:159 of the Dutch Civil Code, Dutch law applies to the Foundation's claims insofar as they relate to the period from 1 January 2012. Insofar as the If claims over this period are based on unjust enrichment, the court will arrive at Dutch law pursuant to Article 10 paragraph 1 Rome II. Article 6 paragraph 1 Rome II also leads to the applicability of Dutch law. Period 1 April 2010 to 1 January 20128.26. The applicable law to the (alleged) wrongful act that occurred before 1 January 2012 must be determined on the basis of the Conflict of Law Act (WCOD) applicable up to that date.8.27. Pursuant to the main rule of Article 3(1) WCOD, obligations arising from tort, delict or quasi-delict are in principle governed by the law of the state where the act took place. According to the Foundation, the unlawful act of Facebook et al. consists in, in summary, that Facebook et al. violated the privacy of the users of the Facebook service in the Netherlands, because Facebook et al. failed to (fully) inform those users about and give their consent. for, in short, the collection and use of personal data. Since the first and most important link in the alleged wrongful act consists of a failure to act, which act (informing and obtaining permission) should have taken place in the Netherlands, in this case the Netherlands must be regarded as the country where the wrongful act took place. the claims, insofar as they relate to the period from April 1, 2010 to January 1, 2012, are therefore governed by Dutch law. Relationship between data protection law and consumer law8.28.Facebook cs furthermore, as part of its cross-appeals, requested that the court declare that data protection legislation precludes consumer law claims (see the claim from Facebook et al. as set out in ground 4.1 under e). The Foundation argued against this that this part of the claim by Facebook et al. in the incident falls outside the procedural agreements made between the parties about what they would submit to the court in the first phase. Since this has not been disputed by Facebook et al., while it has also become insufficiently clear that and why this concerns an incidental claim on which a decision must first be made and prior to the main action, the court will not rule on this part of the claim. 9 Preliminary questions9.1.Facebook et al. requested the court to put a number of preliminary questions to the ECJ during the oral hearing. 9.2. The ECJ has jurisdiction to give preliminary rulings on the interpretation of EU law. If a question in this regard is raised before a court in one of the Member States, that authority may, if it considers a decision on this point necessary for the delivery of its judgment, may request the ECJ to rule on this question (Article 267, second paragraph, Treaty on the Functioning of the European Union). In this case, the court sees no reason to ask questions for a preliminary ruling, because there are no well-founded doubts about the interpretation of EU law. 10 Conclusion and costs of the proceedings in the incidents 10.1. The cross-appeal claims for lack of jurisdiction, detention and inadmissibility are rejected. 10.2. Facebook et al. will be ordered to pay the costs of the incidents as the unsuccessful party. To date, these costs have been estimated on the part of the Foundation at € 3,378.00 in lawyer's salary. In doing so, the court regarded the incidents raised by Facebook et al. as three separate incidents and calculated two points for each of them according to liquidation rate II (3 x 2 x €563.00). 10.3. The subsequent costs claimed can be awarded and are budgeted in the manner stated in the decision.11 The request for an interim appeal11.1.Now that the cross-appeal claims are rejected, the court accedes to Facebook et al.'s request to determine that an interim appeal may be lodged against this interlocutory judgment. To that end, Facebook et al. argue that suspending the proceedings pending the outcome of the appeal will improve efficiency and prevent conflicting decisions on the disputed preliminary questions. 11.2. The Foundation has opposed the opening of an interim appeal. 11.3. Pursuant to Article 337, paragraph 2 DCCP, an appeal can only be lodged against an intermediate judgment at the same time as that of the final judgment, unless the court has determined otherwise. There will be no reason to make an exception to the main rule, because the interim use of legal remedies leads to a delay in the procedure. In the opinion of the court, there are in this case no compelling interests or special procedural reasons to deviate from the principle formulated above. The request of Facebook et al. is therefore rejected.12 The continuation of the proceedings in the main proceedings 12.1.In the joint procedural proposal that the parties submitted to the court on 26 May 2020, they have provided for a period of sixteen weeks after the judgment in the incident for the taking of a statement of defense by Facebook et al. In view of the agreement between the parties and the scope of the case, the court sees no reason to deviate from the term proposed by the parties. The court will therefore refer the case to the roll of 20 October 2021 for statement of defense. 12.2. The parties have asked to be allowed to submit written statements of reply and rejoinder prior to the (substantive) oral hearing. The parties have proposed a period of sixteen weeks for these conclusions. In view of the nature and scope of these proceedings and from the point of view of adversarial procedure, the court will allow the parties to submit rejoinders and rejoinders after the statement of defense, each time with a term of sixteen weeks. An oral hearing will then be scheduled. 12.3.Any further decision is reserved.13 The decisionThe court in the incidents of lack of jurisdiction, detention and inadmissibility 13.1.dismisses the claims,13.2.orders Facebook et al. to pay the costs of the incidents, on the part of the Foundation to date estimated at € 3,378.00, 13.3. orders Facebook et al. to increase the additional costs incurred after this judgment on the part of the Foundation, estimated at € 163.00 in lawyer's salary, on the condition that the judgment has been served and Facebook et al. has not complied with the judgment within fourteen days of notification, with an amount of € 85.00 to the salary lawyer and the writ costs of service of the judgment, 13.4. declares these court costs orders provisionally enforceable, in the main 13.5. determines that the case will again be will come on the roll of October 20, 2021 for statement of defense on the part of Facebook et al,13.6.Defers any further decision.This judgment is pointed out by mr. C. Bakker, chairman, and mr. L. Voetelink and mr. J.T. Cross, judges, and pronounced in public on 30 June 2021.341 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the freedom of movement of such data and repealing Directive 95/46/EC, OJEU 2016, L 119. 2Regulation (EU) No 1215/2012 of the European Parliament and of the Council of 12 December 2012 on jurisdiction, recognition and enforcement of judgments in civil and commercial matters, PbEU 2012, L 351, as last amended on 26 November 2014, PbEU 2015, L 54.3See ECJ 11 October 2007, ECLI:EU:C:2007:595, ro 41, [party] / [party], CJEU 28 January 2015, ECLI:EU:C:2015:37, r.o. 58-65, /Barclays Bank, ECJ 16 June 2016, ECLI:EU:C:2016:449, r.o. 42-46, Universal Music/ [lot].4Compare HR April 12, 2019, ECLI:NL:HR:2019:566, r.o. 3.4.4 and HR 29 March 2019, ECLI:NL:HR:2019:443, r.o. 4.1.4-4.1.5.5See ECJ 27 September 1988, ECLI:EU:C:1988:459, [party]/[party].6 See ECJ 11 October 2007, ECLI:EU:C:2007:595, r.o. 35, [party] / [party].7Compare ECJ 13 July 2006, ECLI:EU:C:2006:458, r.o. 26, [party]/[party], ECJ 11 October 2007, ECLI:EU:C:2007:595, r.o. 40, / [party], ECJ December 1, 2011, ECLI:EU:C:2011:798, ground for appeal 79, /Standard Verlags and ECJ 12 July 2012, ECLI:EU:C:2012:445, r.o. 24, Solvay / Honeywell.8See ECJ 1 December 2011, ECLI:EU:C:2011:798, r.o. 81, [party]/Standard Verlags.9 Established case law since ECJ 30 November 1976, ECLI:EU:C:1976:166, r.o. 25, Kalimijnen.10See, inter alia, ECJ 28 January 2015, ECLI:EU:C:2015:37, r.o. 43, [party] /Barclays Bank, CJEU 16 June 2016, ECLI:EU:C:2016:449, r.o. 25, Universal Music/ [lot].11See, inter alia, ECJ 16 July 2009, ECLI:EU:C:2009:475, r.o. 24, Zuid-Chemie/Philippo's, ECJ 25 October 2011, ECLI:EU:C:2011:685, r.o. 51, eDate Advertising and [party], ECJ 25 October 2012, ECLI:EU:C:2012:664, r.o. 37, [party]/[lot].12CJEU September 12, 2018, ground for appeal 27, ECLI:EU:C:2018:701, [party]/Barclays Bank.13CJEU 19 September 1995, para. 14, ECLI:EU:C:1995:289, [party].14CJEU 25 October 2011, ECLI:EU:C:2011:685, eDate Advertising and [party].15ECLI:NL:HR:2019:92516ECLI:EU: C:2020:105617 ECJ May 12, 2021, ECLI:EU:C:2021:37718CJEU January 25, 2018, ECLI:EU:C:2018:37.19ECLI:DE:BGH:2020:280520BIZR186.17.0 and ECLI:AT:OGH0002: 2020:0060OB00077.20X.1125.0020 HR February 26, 2010, ECLI:NL:HR:2010:BK5756, Boss in Eigen Huis/Plazacasa, ro 4.2.21 Compare HR November 27, 2009, ECLI:NL:HR:2009:BH2162, WorldOnline, r.o. 4.8.22 Amsterdam District Court 9 December 2020, ECLI:NL:RBAMS:2020:6122.23 TK 2011-2012, 33 126, no. 3, p. 12 and 13.24 TK 2011-2012, 33 126, no. 3, p. 5.25 TK 2012-2013, 33 126, no. 7, p. 8 and HR 26 February 2010, ECLI:NL:HR:2010:BK5756, Boss in Eigen Huis/Plazacasa, r.o. 4.2.26 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, OJ EU 1995, L 281. 27 CJEU 1 October 2015, ro 41, ECLI:EU:C:2015:639, Weltimmo,28See ECJ 1 October 2015, r.o. 29-31, ECLI:EU:C:2015:639, Weltimmo, and ECJ 28 July 2016, r.o. 75 and 77, ECLI:EU:C:2016:612, Verein für Konsumenteninformation/Amazon.29See also the judgments of the ECJ regarding Weltimmo and Verein für Konsumenteninformation/Amazon.30See ECJ 13 May 2014, r.o. 55-56, ECLI:EU:C:2014:317, Google Spain and Google.31Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in relation to electronic communications sector.32 Regulation (EC) no. 864/2007 of the European Parliament and of the Council of 11 July 2007 on the law applicable to non-contractual obligations, OJEU 2007, L 199/40.33Compare HR 3 June 2016, ECLI:NL:HR:2016:1054.34type: JTK coll:
