Oracle and Salesforce hit by €10 billion privacy violation class action - and there's an Elliott Management angle to stir the pot further

Profile picture for user slauchlan By Stuart Lauchlan August 14, 2020
Oracle and Salesforce deny allegations made by The Privacy Collective in what could be a precedent setting legal tussle that rumbles on for years.


Oracle and Salesforce are on the receiving end of a €10 billion GDPR class-action suit backed by “an experienced litigation funder” owned and bankrolled by funds managed by shareholder activist firm Elliott Management. 

The Privacy Collective, which promotes itself as “a foundation that acts against violation of privacy rights”, alleges that both Oracle and Salesforce are guilty of “unlawfully collecting and processing data of millions of Dutch internet users”.

In an action filed in the Netherlands, it claims that the two firms collect data from website visitors “at any time and on a large scale” which, when combined with other information, creates a personal profile of individual internet users which can be used to offer personalized online advertisements and unlawfully shared with numerous commercial parties, including adtech companies. It says the two firms collect their information using “among other things - specially developed cookies”.

While it’s Oracle and Salesforce that are the big names to grab the mainstream media headlines, the allegations relate to technologies that both firms acquired in the adtech space - Bluekai, bought by Oracle in 2014 for an estimated $350 million to $400 million, and Krux, bought by Salesforce for $700 million in 2016. Both firms used their purchased tech to flesh out their respective marketing cloud offerings. 


The Privacy Collective estimate of what this could cost Oracle and Salesforce if a case can be successfully made to stick could be north of €10 billion, “based on the number of victims”.  The action in the Netherlands is being led by law-firm bureau Brandeis, which bullishly declares that “Litigation is a martial art”. Christiaan Alberdingk Thijm, lead lawyer in the case said in a statement: 

This is one of the largest cases of unlawful processing of personal data in the history of the internet. Almost every Dutch individual who reads or views information online is structurally affected by the practices of Oracle and Salesforce. Practices that merely serve a commercial purpose…Most people do not know that they have such an online 'shadow profile'. They don't know what it looks like and have certainly not given legitimate consent…These parties violate internet users' right to privacy. The right to protection of personal data and the right to protection of privacy are recognized as fundamental rights.

In the UK, the same basic case is due to be filed later this month at the High Court in London, but will also pull in the country’s Privacy of Electronic Communications Regulation, which governs the use of personal data for marketing communications. The case there is being led by law firm Cadwalader, where partner Melis Acuner is quoted as saying: 

Thousands of organizations are processing billions of bid requests each week with at best inconsistent application of adequate technical and organisational measures to secure the data, and with little or no consideration as to the requirements of data protection law about international transfers of personal data. The GDPR gives us the tool to assert individuals’ rights. The class action means we can aggregate the harm done.


As for Salesforce and Oracle, both firms vigorously deny any wrongdoing. For the former, an official statement says:

Salesforce and another Data Management Platform provider (SIC), have received a privacy-related complaint from a Dutch group called The Privacy Collective. The claim applies to the Salesforce Audience Studio service and does not relate to any other Salesforce service. Salesforce disagrees with the allegations and intends to demonstrate they are without merit.

Oracle has been more pugnacious in its initial response, with Oracle EVP and General Counsel Dorian Daley stating: 

The Privacy Collective knowingly filed a meritless action based on deliberate misrepresentations of the facts.  As Oracle previously informed the Privacy Collective, Oracle has no direct role in the real-time bidding process (RTB), has a minimal data footprint in the EU, and has a comprehensive GDPR compliance program. Despite Oracle’s fulsome explanation, the Privacy Collective has decided to pursue its shake-down through litigation filed in bad faith.  Oracle will vigorously defend against these baseless claims.


Of note is that fact that the litigation is being bankrolled by Innsworth Litigation Funding Ltd, a company based in Chancery Lane in London. The firm states its role as being that of “an experienced litigation funder” that:

funds shareholder litigation and anti-trust litigation on behalf of large groups of claimants. We also fund commercial litigation and arbitration claims in excess of US $100 million, including investment treaty arbitrations.

Its clients are offered the chance to “avoid litigation costs that can be substantial and uncertain” and “avoid the risk of a liability to meet an adverse costs order if the claim fails” in a ‘no win, no fee’ mega-sort of way. Cited case actions include claims against the likes of Mastercard, Volkswagen and BT. The firm has already added Oracle/Salesforce to its list of references on its website as of this afternoon.  

Who is Innsworth? This is where it gets especially interesting for enterprise software market watchers. The company website says: 

Innsworth is owned and funded by funds managed by Elliott Management Corp.

If Elliot Management Corp rings a bell, that may be because this is the activist shareholder/hedge fund firm that caused a stir last year when it took a $1.35 billion investment position in SAP. Its website pitches its function thus:

The firm employs a multi-strategy trading approach that encompasses a broad range of strategies, including, without limitation: distressed securities, equity-oriented, hedge/arbitrage, commodities trading, other debt, portfolio volatility protection, private equity and private credit, and real-estate-related securities.

Elliott, which manages approximately $42 billion in assets, has previously launched activist campaigns at many enterprise tech companies, including Citrix, Cognizant and BMC.  In May of this year, Elliott Management purchased more than $21 million of Oracle stock, 440,000 shares. Elliott does not presently have an interest in Salesforce.

My take

It would not at this point be appropriate to get into commenting on the validity or otherwise of a contentious piece of litigation that will potentially drag on through the courts for years to come. That said, I do find the Innsworth/Elliott involvement very interesting and worthy of future contemplation. It’s also more than likely that this will turn out to be an important adtech test case that needed to happen at some point, whoever ended up having to fight it out. Everyone involved here has reason to pull all the stops out to prosecute/defend the allegations on the table. Without doubt, we shall return to this.