Case C-523/25, Stichting Data Bescherming Nederland – who may sue Amazon for everyone?
The GDPR gives individuals a right to compensation and lets them mandate a body to claim it for them. The Netherlands lets a body claim it for individuals who have mandated nothing. The Rechtbank Rotterdam asks whether the two can coexist.
Facts
Stichting Data Bescherming Nederland (SDBN), a foundation, is suing Amazon Europe Core, Amazon EU, Amazon Media EU and Amazon.com, Inc. before the Rechtbank Rotterdam under the Wet afwikkeling massaschade in collectieve actie (WAMCA), the Dutch statute on collective actions for damages. Under WAMCA a representative body may bring a claim for compensation on behalf of a class of persons who have not instructed it; class members are bound unless they opt out, at one of two points fixed by the court. WAMCA also imposes its own admissibility conditions on the representative — similarity of the claims, representativeness, experience and expertise, requirements as to its articles of association. Article 80(1) of the GDPR provides that a data subject “shall have the right to mandate a not-for-profit body, organisation or association” meeting certain conditions to exercise the rights in Articles 77 to 79 and, “where provided for by Member State law”, the right to compensation in Article 82. Article 80(2) lets Member States allow such a body to act “independently of a data subject’s mandate” — but only to lodge a complaint and to exercise the rights in Articles 78 and 79, not to claim damages. The referring court asks five questions about how far Dutch law may go.
Questions Referred
1. Article 80(1) of the GDPR sets requirements for an interest group as referred to in that provision. Does EU law permit the Netherlands to include in the [Wet afwikkeling massaschade in collectieve actie (Law on mass damages settlement in collective actions [WAMCA]) further admissibility requirements for interest groups bringing claims as referred to in Articles 77, 78, 79 and 82 of the GDPR on behalf of the natural persons concerned?
2. Are the admissibility requirements in the WAMCA, in particular with regard to similarity and representativeness, permissible in the light of Article 80(1) of the GDPR for representatives who wish to bring a collective action for damages on behalf of data subjects against a controller or processor for infringements of the GDPR?
3. Does the requirement in Article 80(1) of the GDPR that an interest group be active in the field of protecting the rights and freedoms of data subjects in relation to the protection of their personal data go further than, or differ from, the national requirement that the interest group have sufficient experience and expertise with regard to the procedure to be followed (Article 3:305a(2)(e) of the Burgerlijk Wetboek [Civil Code] [BW]), in conjunction with the requirements for the Articles of Association (Article 3:305a(1) of the BW)? Does the activity requirement in Article 80(1) of the GDPR mean that the interest group must have a track record?
4. Do the concept of ‘mandate’ in Article 80(1) of the GDPR and/or the provision of Article 80(2) of the GDPR preclude national legislation under which an interest group that meets the requirements of Article 80(1) of the GDPR may bring a collective claim for damages on behalf of data subjects against a controller or processor for infringements of the GDPR, even though that interest group has not been instructed to do so by the data subjects?
5. In the context of question 4, when interpreting the concept of ‘mandate’ in Article 80 of the GDPR, to what extent is it relevant that, under national legislation (the WAMCA), the data subject is not required to indicate in advance that he or she wishes to be bound by the collective action for damages? In addition, he or she may (where applicable) choose in writing at two points in time not to make use of the representation by the representative and therefore not to be bound, namely (i) within a period to be determined by the court from the moment that the representative is appointed by the court as (exclusive) representative (Article 1018f(1) of the Wetboek van rechtsvordering (Code of Civil Procedure) [Rv]) and (ii) within a period to be determined by the court in the event that the parties have concluded a settlement agreement (Article 1018h(5) of the Rv).
Sources
OJ notice C/2025/5679 (EUR‑Lex) · Case file on CURIA · Regulation (EU) 2016/679
Comment
Questions 4 and 5 are the reference; the first three are about the gate, the last two about whether the gate leads anywhere. Article 80 is built on the mandate. Paragraph 1 lets a data subject appoint a body to act; paragraph 2 lets Member States dispense with the appointment, but expressly only for complaints and for the remedies in Articles 78 and 79 — the damages claim in Article 82 is left out. On its face, that is a legislative choice: a body may act for data subjects without their mandate in every respect except money. An opt-out damages class, in which the body claims compensation for people who have never heard of it, is precisely what Article 80(2) omits.
The Dutch answer, which the referring court sets out with some care in question 5, is that WAMCA is not a mandate-free regime but a mandate-by-default one: the data subject may leave at two defined moments, and one who stays has chosen to be represented. Whether silence at an opt-out window is a “mandate” within Article 80(1) is the question on which the case turns, and the Court has two ways to read it. One is that “mandate” means an act of the data subject, so that the Dutch model is excluded by Article 80(2)’s omission of damages. The other is that Article 80 sets a floor of representation Member States must allow, not a ceiling on what they may allow — the reading the Court gave the provision in Case C‑319/20, Meta Platforms Ireland (ECLI:EU:C:2022:322), when it held that Article 80(2) does not preclude national law allowing a consumer association to sue “in the absence of a mandate conferred on it for that purpose” on the basis of unfair commercial practices or consumer protection law. That case, though, concerned an action to stop the infringement under Article 80(2); it did not have to confront the omission of Article 82.
The first three questions matter because of how the Representative Actions Directive interacts with the GDPR. WAMCA’s conditions — similarity, representativeness, expertise, the articles of association — are the general Dutch filter for class actions; Article 80(1) has its own, narrower filter — a not-for-profit body, properly constituted, with public-interest objectives, “active in the field” of data protection. Whether national law may add conditions to a body that already meets the GDPR’s is a question about whether Article 80 is exhaustive. The referring court’s third question — does “active in the field” require a track record? — shows why it matters: a foundation set up to bring one case against Amazon may satisfy WAMCA and yet not be “active” in any sense the GDPR would recognise.
The commercial stakes are the reason the case is worth watching. Dutch opt-out actions have become the vehicle of choice for privacy litigation against platforms in Europe, because the class is large by default and the defendant cannot pick off individual claimants. If the Court reads Article 80 as excluding mandate-free damages claims, that vehicle loses its GDPR cargo; if it reads it as a floor, every Member State with an opt-out mechanism becomes a venue for Union-wide privacy classes.