Late last year, a Dutch consumer rights group sued Amazon, claiming that the company illegally tracks users’ online activity without their permission, an allegation eerily similar to a 2021 case in which Amazon was found to have violated the GDPR. The class action is one of the first major cases since the EU made it easier for consumers to file class-action claims. But whether the new law will be a boon for wronged consumers or a boondoggle that will overtax the court system remains to be seen, writes law student Chelsea Burkhart.
The newest Amazon lawsuit in the Netherlands is poised to potentially be a battleground for public policy considerations, extending far beyond the individual case. Stichting Data Bescherming Nederland (SDBN) filed a class-action lawsuit against tech giant Amazon for violating EU privacy law after the EU implemented a law in June making it easier for consumer groups to bring class-action cases against companies. While class-action suits have long been an expected staple in U.S. courts, this new law will create a shift in not only how consumers seek redress, but also in how EU law firms operate.
Background of the case
Looking at this case generally, SDBN alleges that Amazon collects personal data from cookies and tracks consumers’ behavior across the internet to sell targeted advertising space without their permission.
According to SDBN, the new class-action suit represents around 5 million Amazon account holders in the Netherlands whose behavior is tracked across various websites and Amazon in order to sell specifically targeted advertisement space.
If that sounds familiar, it might be because Amazon was fined a record $887 million dollars for a similar EU data-protection law violation in 2021. There, Amazon was fined for violating the 2018 GDPR, a piece of legislation aimed to protect consumers’ data collected by companies by ensuring consumers’ consent to data tracking is clear and easily revocable, as well as ensure that companies must notify data protection authority about a data breach within 72 hours of knowledge.
Luxembourg’s privacy regulator fined Amazon the record $887 million for noncompliance with the GDPR and required Amazon to revise undisclosed business practices. Amazon responded that it was undisputed that no data breach occurred and that how it shows relevant advertising to customers is subject to interpretations of the GDPR. The new SDBN suit partly mirrors the previous record-breaking fine because of the dispute over tracked behavior and targeted advertisement, which Amazon maintains is subject to interpretation.
Given the fact that Amazon got well more than a slap on the wrist for similar misconduct in recent years, combined with other tech giants also being sued for similar personal data and targeting advertisements, it seems that the nearly 5 million consumers in this class-action suit have a firm leg to stand on. Amazon, however, maintains that privacy and security of its customers is its top priority, and the company has appealed the previous Luxembourg privacy regulator’s penalty.
Privacy Law Compliance Parallels and Peculiarities: Navigating the Consumer Privacy Compliance Circus
Are states stepping into the void — or muddying the waters — on data protection laws?
Read moreDetailsA test of new EU law
Of course, a compliance program need not be perfect to be effective and evidence of misconduct itself does not equate to ineffectiveness. What is a good indicator of an ineffective compliance system? One indicator might be when a company knows of a problem and instead of self-remediation to prevent similar events in the future, continues the same misconduct to maximize profits.
Whatever you might think of Amazon’s action or the legal merits of this new class-action suit, however, one central issue that might silently dominate the outcome is the delicate balance between bolstering consumer protection through robust compliance systems and preserving court resources in light of the EU’s new class-action laws.
This battle of consumer protection is part of the broader challenge of reconciling consumer interests while acknowledging the practicalities of the legal system in a booming technological age. EU legislation over the past five years has trended toward protecting its citizens both through privacy regulation and the ability to take part in class-action suits, which until recently were predominantly an American form of redress.
The issue, however, is whether European courts are prepared for this aggressive and costly form of action. Not only can class-action suits be wildly expensive for companies, certainly causing fear for companies’ conduct in Europe, but they also weigh heavy on court resources. The complexity of these suits and the simple allocation of court resources to oversee class members, manage the litigation process and ensure appropriate distribution of settlement or judgment will be a huge new strain on European courts and law firms.
This is especially true given that the latest EU class-action regime doesn’t actually create new corresponding courts. Instead, EU members are directed to create legislation enabling suits within existing court structures. Beyond the strain on EU member courts, who are not as familiar with the aggressive U.S.-style class-action suits, companies are still grappling with how suits in Europe will affect their current conduct and exposure. Similar to the courts, companies operating in Europe are either unfamiliar with the magnitude of U.S.-style class actions, or they previously found comfort in operating without the risk of these suits.
The outcome of this case, therefore, might not be as simple as finding and addressing corporate wrongdoing in Amazon’s practices (again or for the first time – pending the outcome of the 2021 fine and appeal). Instead, considering that this case represents roughly 5 million Amazon account holders, the risk of waves of similar class-action suits might be too great for European courts at this time.
On top of the risk of court resources, companies across Europe will also need to weigh the cost of continuing business practices as they stand with the risk of reputational harm and monetary fines from class-action suits, as well as the cost of complying with the data protection regulations against their ad revenue. While emboldening consumers, new class-action legislation will start to pinch courts and companies alike.
All this to say: The outcome of this case will offer insights into future implications for both businesses, mainly massive corporations, and the EU’s legal system as it navigates the evolving terrain of modern consumer protection and class-action litigation. Clearly passed to protect and offer consumers aggressive redress for corporate harm, the EU legislation risks biting off more than it can chew without adequate court resources.
Compliance officers across Europe for now have the ability to weigh these risks before additional waves of class-action come. Ultimately, though, compliance departments and businesses worldwide will find some direction as they seek to tie all loose ends (or put out fires) by watching Amazon deal first hand with Europe’s newest class-action legislation. The outcome of this battle for consumers’ rights against court resources and company profits might simultaneously rely on and decide the future of European consumer data privacy protection.
Chelsea Burkhart is a third-year law student at the Benjamin N. Cardozo School of Law, with a particular interest in international trade and global corporate compliance. She graduated from the George Washington University's Elliott School of International Affairs in 2019 and worked for NGP VAN + Bonterra Technology before and throughout attending law school. 
