In an interim judgment of November 9, 2022, the District Court of Amsterdam (“Court”) affirmed its jurisdiction in a case brought by several Dutch foundations^[1] (“Foundations”) against TikTok Technology Limited Ireland and affiliated companies (“TikTok”) for violations of the General Data Protection Regulation (“GDPR”).^[2] The decision provides valuable guidance on the relationship between Art. 79 and 80 GDPR and the Brussels I Recast Regulation. It also shows how defendants outside the EU can be brought into Dutch courts.

The Foundations filed a representative action against TikTok under Art. 3:305a Dutch Civil Code, known as the WAMCAregime.^[3] In essence, the Foundations alleged that TikTok violated privacy rights of children and adults resident in the Netherlands. In addition, they claim that TikTok processes its users’ personal data and shares these data with third parties without a proper legal basis, which qualifies as wrongful act under EU and Dutch law (onrechtmatige daad). The Foundations seek declaratory judgment to that effect and compensation for affected Dutch TikTok users.

The Court’s jurisdiction was contested. TikTok, including all its affiliated companies, is based outside the Netherlands and does not have an “establishment” there. Accordingly, jurisdiction was not triggered under Art. 79(2) GDPR sentence one. Further, TikTok argued that (i) the Foundations cannot rely on Art. 79(2) GDPR sentence two, which allows proceedings to be brought “where the data subject has his or her habitual residence,” and that (ii) the GDPR’s rules on jurisdiction are exclusive and preclude relying on the Brussels I Recast Regulation.

However, the Court rejected both arguments and affirmed its jurisdiction under Art. 79(2) sentence two in combination with Art. 80 GDPR and – for wrongful act claims – under the Brussels I Recast Regulation.

With respect to Art. 79(2) GDPR sentence two, the question the Court had to answer was whether the Foundations as representative bodies – or only data subjects individually – could rely on this provision. Pursuant to Art. 80 GDPR, a representative body can exercise the data subjects’ rights referred to, among others, in Art. 79 GDPR. The court clarified that Art. 80 GDPR’s reference to “rights referred to in [..] Art. 79 GDPR” does not distinguish between substantive and procedural rights and, thus, extends to the jurisdictional rule in Art. 79(2) GDPR sentence two. In other words, representative bodies under Art. 80 GDPR can indeed rely on Art. 79(2) GDPR sentence two to establish jurisdiction.

Furthermore, the Court held that the GDPR’s rules on jurisdiction are not exclusive. While the GDPR in recital 147 explicitly states that the Brussels I Recast Regulation’s general rules on jurisdiction are without prejudice to the GDPR’s special jurisdictional rules, the GDPR does not, as lex specialis, preclude reliance on the Brussels I Recast Regulation. Instead, both sets of rules coexist and can be relied upon where the respective requirements are met. Therefore, the Court’s jurisdiction for claims relating to wrongful acts allegedly committed by TikTok entities within the EU – whether or not arising from a GDPR violation – can be based on Art. 7(2) Brussels I Recast Regulation because the losses were incurred in the Netherlands (Erfolgsort).

Finally, the Court held that it has jurisdiction also regarding claims against TikTok entities domiciled outside the EU. For these claims, the Court relied on Art. 7(1) Dutch Code of Civil Procedure. This provision grants jurisdiction to Dutch courts if the respective claims are connected with each other in such a way that a joint consideration is justified for reasons of efficiency, which the Court found to be the case with respect to the Foundations’ claims.

Of note is that the Court rejected TikTok’s requests (i) to submit the question of jurisdiction to the Court of Justice of the European Union, (ii) for a stay of proceedings, and (iii) for appeal on the interim judgment. It seems the Court is not willing to lose time on jurisdiction and instead moves on to the next stage of the proceedings, which will address the admissibility of the claimants, the assessment of the funding agreements, the applicable law, and the designation of an exclusive representative.

It remains to be seen how TikTok will continue to defend against this collective action case that it is facing in the Netherlands. It is without doubt, however, that this interim judgment has marked the leading position that Dutch courts are willing to take when it comes to collective actions against large multinationals. Based on this interim judgment on jurisdiction, it is to be expected that in the near future more cases will be brought before Dutch courts under the legal framework of the WAMCA.

Anton Burri^[4] and Adrianus van Heusden^[5]

[1] Onderzoek Marktinformatie, Take Back Your Privacy, and Massaschade & Consument.

[2] Rb Amsterdam 9 november 2022, ECLI:NL:RBAMS:2022:6488.

[3] Resolution of Mass Damage in Collective Action Act (Wet Afwikkeling Massaschade in Collectieve Actie).

[4] Faculty of Law, University of Lucerne, Switzerland.

[5] Rotterdam Institute of Law and Economics, Erasmus University Rotterdam, The Netherlands.