NL

Share on facebook
Share on linkedin
Share on twitter

The article was authored by Rebecca Rumbul, UK claimant for the case against Oracle and Salesforce.

It was announced on Friday 14th August 2020 that legal claims were being filed against Oracle and Salesforce in the UK and Netherlands for breach of GDPR. The claims concerned the use of Third Party AdTech tracking cookies (BlueKai and Krux), the ‘Real-Time Bidding’ processes used to target adverts to individual users, and the implications for personal data. The claims are being taken forward in the form of ‘class actions’, which means that the named representative claimants are bringing the claim not only for themselves, but on behalf of everyone in the jurisdiction that is affected.

The combined claims could exceed €10 billion, as there are potentially millions of individuals that have these tracking cookies on their systems, most of whom I suspect have no idea that their personal data and website use is being tracked across the internet. One of the key issues we have with these cookies is the fact that it is almost impossible to know what personal data is being collected/traded/aggregated or by whom. It is therefore impossible to give any kind of meaningful consent to this activity. Those annoying ‘Accept All’ cookie pop ups you get on every website these days are supposed to enable you to consent to the use of your personal data and the placing of cookies on your system, but do you really know what they are doing?

Having advertising targeted at you based on your recent holiday search browsing may seem pretty benign, but would you really be comfortable having all of the websites you visit being added to your profile? What about that time you had a weird rash and visited a few medical websites to try and self diagnose it? What about when you were a bit worried about making ends meet and ended up looking into loans and how to avoid potential bankruptcy proceedings? Would you want all of that information traded or linked together as part of an individual record, without your knowledge or any ability to see or challenge it? Probably not.

We really need people to express their support for this action. You can do this with only one click on our website. It will only take a couple of seconds and it really helps to bolster our case.

I am writing about this here, as I am the named claimant in the UK. I am working as part of The Privacy Collective as an overarching and organising body operating across the two jurisdictions. As a lone individual, I could not possibly fund the legal costs for this out of my own pocket, and I am therefore working with Innsworth, a professional litigation funder who are supporting this action financially, and with Cadwalader, a prominent international law firm who are conducting all of the legal wizardry. I am truly delighted to be working with such serious, engaged and expert people who are just as reasonably alarmed as I am about the erosion of our personal privacy rights by the multi-billion dollar AdTech industry.

I should finally state that I am leading this action as a private individual. I continue to do my day job, which I love and am fully committed to, full time. While my wonderful colleagues at mySociety are very supportive of my involvement, this action remains separate. As such, if you would like to talk about the case, please contact me directly rather than approaching mySociety.

I will be writing more on this case, about specific points and general updates, as things progress. In the meantime, if you want to learn more about AdTech, Privacy International have some really good resources available here.