Stichting Data Bescherming Nederland (SDBN) alleges that Amazon processed the data of about 5 million Dutch account holders in breach of the General Data Protection Regulation (GDPR). It seeks an injunction and damages. On July 23, 2025, the District Court of Rotterdam stayed the case and referred questions to the Court of Justice of the European Union (CJEU). Other Dutch privacy cases await the answer.
Latest development Jul 23, 2025
On July 23, 2025, the District Court of Rotterdam referred questions to the Court of Justice of the European Union and stayed the case. The questions concern how Article 80 of the General Data Protection Regulation applies to Dutch opt-out collective actions. The reference was lodged on August 1, 2025, as Case C-523/25.
Why it matters
The CJEU’s answers in Case C-523/25 will decide whether Dutch foundations can claim GDPR damages for millions of people on an opt-out basis. Dutch courts have paused privacy claims against Meta, Google, and TikTok until it rules.
Background
Stichting Data Bescherming Nederland (SDBN), a foundation set up in December 2021, sued Amazon’s Luxembourg operating companies and Amazon.com in the District Court of Rotterdam in October 2023. A U.S. litigation funder affiliated with Longford Capital Management finances the case. SDBN alleges that Amazon processed account holders’ personal data in breach of the General Data Protection Regulation (GDPR) and the Dutch Telecommunications Act, including by failing to secure it. It seeks declarations, orders to stop the alleged breaches and delete the data, and damages for material and non-material harm in an amount for the court to set.
Amazon argues that SDBN fails the admissibility requirements of the Dutch Act on Collective Damages Claims (WAMCA), including similarity of interests and representativeness, and that its funder’s profit motive prevails. It also argues that SDBN is not active in data protection within the meaning of Article 80 of the GDPR because it has no track record. On November 13, 2024, the court held that it has jurisdiction and that Dutch law governs the claims. It also proposed to refer questions to the Court of Justice of the European Union (CJEU). On March 5, 2025, it refused a request by Stichting The Privacy Collective to join the case.
On July 23, 2025, the court referred questions to the CJEU and stayed the case. The questions ask whether EU law allows the WAMCA’s extra admissibility requirements for privacy claims and whether Article 80 requires a track record. They also ask whether a foundation may claim GDPR damages without a mandate from each person under the Dutch opt-out system. The reference was lodged on August 1, 2025, as Case C-523/25. The District Court of Amsterdam and the Court of Appeal of Amsterdam have paused GDPR claims against Meta, Google, and TikTok until the CJEU rules.
Timeline 5 events
-
OtherAmsterdam court pauses Meta privacy claims pending Case C-523/25
The District Court of Amsterdam cited the Rotterdam reference when it stayed collective damages actions against Meta, one of several Dutch privacy cases on hold.
-
OrderRotterdam court refers questions to the EU Court of Justice
The court asked how Article 80 of the General Data Protection Regulation applies to Dutch opt-out collective actions and stayed the case. The reference was lodged on August 1, 2025, as Case C-523/25.
District Court of Rotterdam, ECLI:NL:RBROT:2025:9088DPCuria: Referral C-523/25
-
OrderRotterdam court refuses The Privacy Collective’s request to join the case
The court held that the closed system of the Dutch collective action law leaves room for only one representative organization on the claimant side.
District Court of Rotterdam, ECLI:NL:RBROT:2025:2981The Privacy Collective
-
JudgmentDistrict Court of Rotterdam asserts jurisdiction and proposes EU reference
The court held that it has jurisdiction and that Dutch law governs the claims, and invited the parties to comment on draft questions for the Court of Justice.
-
FilingStichting Data Bescherming Nederland sues Amazon in Rotterdam
The foundation alleged breaches of the General Data Protection Regulation and the Dutch Telecommunications Act affecting Dutch Amazon account holders, and sought damages and injunctions.
Rechtspraak register: summons extract, SDBN v. AmazonRechtspraak: central register of collective actions