News Update Class Actions

In its interim judgment (only in Dutch) of 9 November 2022, the Amsterdam District Court decided that Dutch courts have jurisdiction over claims brought by a number of Dutch foundations ("Foundations") against TikTok Ireland and its affiliated companies ("TikTok companies") for infringement of the General Data Protection Regulation (GDPR).

According to their articles of association, the Foundations' objects include representing the interests of natural persons who use online services and whose rights to the protection of privacy or to the protection of personal data are violated at any time. The Foundations have filed claims as referred to in Article 3:305a of the Dutch Civil Code ("DCC"). All Foundations hold each TikTok company individually responsible for the infringement of privacy rights of children in the Netherlands. One Foundation's claims extend to adults as well. In addition, according to the Foundations, the activities of the TikTok companies qualify as 'wrongful act' (onrechtmatige daad): they process the personal data of TikTok application users and share the data with third parties without a legal basis for doing so. The Foundations are seeking various declarations to the effect that the TikTok companies act contrary to GDPR provisions, and request that the TikTok companies be ordered to pay compensation for material and immaterial damage of TikTok application users.

Jurisdiction of Dutch courts: assessment under both specific GDPR jurisdiction rules and general jurisdiction rules

Specific GDPR jurisdiction rules

Most of the Foundations' claims relate to the alleged infringement of GDPR provisions. In the interim judgment, the court states that TikTok Ireland must be regarded as the controller and processor of personal data within the meaning of the GDPR. According to the court, insofar as the claims are based on the GDPR, the specific jurisdiction provisions in the GDPR apply instead of the general jurisdiction rules of the Brussels I Recast Regulation. Under the GDPR, Dutch courts do not have jurisdiction under Article 79 paragraph 2, first sentence of the GDPR, as TikTok Ireland has its habitual residence in Ireland. However, the court declares that it has jurisdiction over the claims under the second sentence of Article 79, paragraph 2 GDPR, as the data subjects in these proceedings have their habitual residence in the Netherlands. The court points out that Article 80 GDPR provides for the possibility for a representative body active in the field of protection of data subjects' rights and freedoms with regard to their personal data to exercise these rights without making a distinction between procedural and substantive rights. This means that, as far as the court's jurisdiction is concerned, the Foundations, qualifying as such bodies, can rely on the habitual residence of the data subjects. As the Foundations are taking part in the proceedings against the TikTok companies under Article 3:305a DCC, they are regarded as representing data subjects within the meaning of Article 80 of the GDPR.

General jurisdiction rules

Insofar as the Foundations' 'wrongful act' claims against the TikTok companies that have their habitual residence outside the Netherlands but within the European Union are not directly based on the GDPR, the court declares itself to have jurisdiction under Article 7 paragraph 2 of the Brussels I Recast Regulation. This is because the data subjects suffer direct loss in the Netherlands.

The court further accepts jurisdiction over the claims against the TikTok companies that have habitual residence outside the European Union, under Article 7 paragraph 1 Dutch Code of Civil Procedure. In the view of the complex facts and the sufficiently close connection between the various claims against the various companies, joint handling of the claims is justified for reasons of efficiency.

The court rejects the TikTok companies' request to ask the Court of Justice of the European Union for a preliminary ruling on two issues: (i) the relationship between the jurisdiction provisions of the GDPR and the Brussels I Recast Regulation and (ii) whether a representative body can rely on Article 79 paragraph 2, second sentence of the GDPR Regulation when taking part in proceedings on GDPR infringement before a civil court. The court also rejects the request for a stay of proceedings connected with pending public law proceedings, as it considers it more efficient to first deal with the next formal steps in the Dutch proceedings, such as the admissibility requirement.

Third-party litigation funding agreement and exclusive representative body

To rule on the admissibility of the Foundations' claims and to appoint an exclusive representative body, the court also orders each Foundation to submit a third-party litigation funding agreement to the court. Then the case is set to continue to the next formal stage: the TikTok companies will submit their arguments on the admissibility of the claims, the appointment of the exclusive representative body, and the applicable law.

Sign up for the News Update Class Actions.