Oracle and Salesforce Face GDPR Class Action Lawsuits Over Use of Third-Party Cookies

A European non-profit the Privacy Collective has filed a class-action lawsuit against Oracle and Salesforce in Netherland asserting that the companies violated GDPR in how they process and share personal data collected via third party cookies.  The lawsuit is the biggest-ever GDPR class action filed in the Netherlands.  A similar lawsuit is expected to be filed in England and Wales later this month.

The allegations in the lawsuits focus on the companies’ third-party tracking cookies, BlueKai and Krux which are hosted on a number of popular websites, including Amazon, Booking.com, Dropbox, and Spotify.  Salesforce purchased Krux in 2016 and Oracle bought BlueKai in 2014.  The Privacy Collective claims that companies are unlawfully collecting and processing the data of internet users in violation of the GDPR requirements, including an obligation to obtain consent of data subjects to process their personal data.  The personal information collected by the BlueKai and Krux feeds the real-time-bidding (RTB) process that allows for high velocity trading of profiles of individual web users in order to run dynamic ad auctions and serve behavioral ads. The RTB process allows personalized advertisements specifically targeted by age, gender, location, preferred device and interests, in a way that’s also aware of what activity users conducted online over time.

The GDPR in Article 4 defines “consent” to be “a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.  The Privacy Collective will argue that consent given by website users to use cookies would not affect their rights as class members as “any consent to the sharing of personal data for the purpose of profiting from real time bidding was not valid.”  Plaintiff seeks recovery of €500 per class member due by each of the defendants, which could amount of up to €10 billion in total fines.

Sources:
https://techcrunch.com/2020/08/14/oracle-and-salesforce-hit-with-gdpr-class-action-lawsuits-over-cookie-tracking-consent/?guccounter=1
https://www.theregister.com/2020/08/14/privacy_collective_sues_oracle_salesforce_gdpr/
https://www.forbes.com/sites/carlypage/2020/08/14/oracle-and-salesforce-hit-with-10-billion-gdpr-class-action-lawsuit/#5e5f69b0323c

Ask Clarip today how we can solve your biggest privacy compliance pain points, Call Clarip at 1-888-252-5653