Now Salesforce and Oracle face UK privacy class action

Salesforce and Oracle are set to join Facebook, easyJet, TalkTalk, Virgin Media and Google and be summoned to the High Court to defend themselves against yet another data protection class action lawsuit in the UK.

The £10bn lawsuit, filed by privacy campaigner and data protection specialist Rebecca Rumbul, follows the launch of a parallel action in the Netherlands backed by Dutch group The Privacy Collective, which is seeking €10bn (£9bn).

The case alleges Salesforce and Oracle collect users’ personal data without their consent and then auction it off to other companies without their knowledge. The UK lawsuit demands a £500 payment for each user who has not consented to the use of their sensitive personal data.

The suit claims that both have used third-party cookies Bluekai and Krux to misuse consumers’ personal data. The cookies, which are hosted on multiple websites including Ikea, Twitch, Dropbox, Booking.com, and Comparethemarket, are used for dynamic ad pricing services.

It insists that Oracle and Salesforce held on to personal data that consumers had not proactively consented to share and took an inconsistent approach to securing sensitive information. The lawsuit further accuses the companies of facilitating sales using harmful ads.

According to the Privacy Collective and Rumbul, both companies sell profiles created from the personal data they have gathered from users to other companies via real-time bidding without the knowledge or consent of the users.

The UK suit, led by law firm Cadwalader, alleges that this process is done without clear consent and is therefore a breach of GDPR.

Rumbul said: “Enough is enough. I am tired of tech giants behaving as if they are above the law. It is time to take a stand and demonstrate that these companies cannot unlawfully and indiscriminately hoover up my personal data with impunity. The Internet is not optional any more, and I should be able to use it without big tech tracking me without my consent.

“The data these companies are compiling on ordinary citizens is terrifying. With their tracking technologies in use across the most popular websites, it is hard to escape from their data collection.”

Rumbul said that although both software firms could ignore her complaints as a lone individual, by becoming a class representative on behalf of millions, she could more effectively hold the advertising technology industry to account.

“I don’t believe that these companies, who profit from the sale of my personal data to third parties, currently respect the laws that are supposed to protect my privacy. Perhaps £10bn given back to consumers in England and Wales will change that.”

A Salesforce spokesperson said: “At Salesforce, trust is our number one value and nothing is more important to us than the privacy and security of our corporate customers’ data.

“We design and build our services with privacy at the forefront, providing our corporate customers with tools to help them comply with their own obligations under applicable privacy laws – including GDPR – to preserve the privacy rights of their own customers.

“Salesforce and another data management platform provider received a privacy-related complaint from a Dutch group called The Privacy Collective in The Netherlands in August 2020. Salesforce and the same data management platform provider have since received a similar privacy complaint in the UK from Dr Rebecca Rumbul. The claim applies to the Salesforce Audience Studio service and does not relate to any other Salesforce service.”

“Salesforce disagrees with the allegations and intends to demonstrate they are without merit. Our comprehensive privacy programme provides tools to help our customers preserve the privacy rights of their own customers.

The lawsuit proceedings will be stayed until the outcome of the Lloyd vs Google case at the Supreme Court, being heard in April next year, following a Court of Appeal ruling in October last year. If Lloyd wins, this could pave the way for scores of similar class actions in the UK.