The Dutch Data Protection Agency has launched a new class action suit, this time against Amazon. This company will collect more data than necessary, even if users refuse cookies. The data will also be sent to third parties. The corporation wants compensation for this.

Basis He writes It first wants to hold Amazon accountable and calls for a consultation. If that doesn’t work, the foundation wants to start a lawsuit. The Dutch can do that subscription, which only requires your name, date of birth, and email address. Applicants must also have lived in the Netherlands between November 2014 and now. The foundation does not explicitly ask if applicants have an Amazon account, but they say they do in frequently asked questions However, only account holders are potential victims.

The organization has now sent a letter of claim to Amazon. In it, the foundation identifies various complaints about violations Amazon may commit. This message is not public and the organization does not want it to be sent, but it tells Tweakers about the specific reasons Amazon will be held accountable. These are various violations of the General Data Protection Regulation (GDPR). These are violations of Sections 3 and 13, which deal with the information Amazon must provide about the data it collects, and Section 7, which deals with how that information is described. Amazon is also in violation of Article 11 of the GDPR, which requires an explanation of the data retention period and how customers can exercise their GDPR rights.

Finally, Amazon is in violation of Section 12, which deals with data transfers outside the United States. Amazon invokes the Privacy Shield data agreement, but the European Court of Justice has since declared it illegal.

The Foundation also relies on several different GDPR articles. For example, the SDBN says there is a “lack of adequate basis” for placing cookies. Amazon.com She says herself It relies on consent as a basis. Amazon will not further reduce the data, according to the SDBN, the company processes private personal data and will not adequately protect the data. “These are the most significant violations,” said a spokesperson for the foundation. “But it is not an exhaustive list.”

Previous GDPR fine

The foundation says many of the complaints are consistent with those of Luxembourg’s privacy authority. It fined Amazon €746m in 2021, but the fine was never made public, so it’s not entirely clear what violations Amazon committed. Incidentally, Amazon has appealed against this fine and does not have to make any changes to the policy as long as this process is ongoing.

The foundation cites various data breaches as a reason for compensationThe organization also says that Amazon does not protect customer data well, but cites separate examples of information collected about cookies and tracking. The company cites a handful of data breach incidents, some of which occurred prior to May 2018, when the General Data Protection Regulation came into force. The organization mentions, among other things, incidents such as when Amazon accidentally posted other usernames and a major data leak on Twitch, although the source code and internal documents were mainly leaked and there was no user data.

Damages

SDBN says it is seeking damages on behalf of all victims with an account. That will be difficult. The European Court of Justice recently concluded that damages from data breaches must be proven. That seems difficult with a group claim. In its response, the foundation says: “The damage to him relates to two parts.” Non-pecuniary damages, which are regularly awarded in case law in individual cases (amounts between €250 and €2,000 are often awarded), are central to this, as the aggrieved parties have lost control of their personal data due to Amazon, while Amazon does not provide a level Adequate protection for the data you collect and compensation. This is the value of personal data and the payment of profits that Amazon has generated through the data collected.”

Victims who join the claim do not have to pay for it. The foundation receives an advance from a law firm to start the case. If damages are awarded, a maximum of twenty percent will be withheld from the amount to pay for the case.