Case C-523/25, Stichting Data Bescherming Nederland: Request for a preliminary ruling from the Rechtbank Rotterdam (Netherlands) lodged on 1 August 2025 – Stichting Data Bescherming Nederland (SDBN) v Amazon Europe Core Sàrl, Amazon EU Sàrl, Amazon Media EU Sàrl, Amazon.com, Inc.
Date: 2025-08-01
Institutions: Court of Justice
Subjects: alternative dispute resolution, civil liability proceedings, collective redress, damages, data protection, data-processing law, interest group, personal data, right of action








C_202505934EN.000101.fmx.xml












Official Journal of the European Union


EN
C series













C/2025/5934


17.11.2025






Request for a preliminary ruling from the Rechtbank Rotterdam (Netherlands) lodged on 1 August 2025 – Stichting Data Bescherming Nederland (SDBN) v Amazon Europe Core Sàrl, Amazon EU Sàrl, Amazon Media EU Sàrl, Amazon.com, Inc.


(Case C-523/25, Stichting Data Bescherming Nederland)

(C/2025/5934)
Language of the case: Dutch

Referring court

Rechtbank Rotterdam

Parties to the main proceedings


Applicant: Stichting Data Bescherming Nederland (SDBN)

Defendants: Amazon Europe Core Sàrl, Amazon EU Sàrl, Amazon Media EU Sàrl, Amazon.com, Inc.

Questions referred







1.


Article 80(1) of the GDPR (1) sets requirements for an interest group as referred to in that provision. Does EU law permit the Netherlands to include in the [Wet afwikkeling massaschade in collectieve actie (Law on mass damages settlement in collective actions [WAMCA]) further admissibility requirements for interest groups bringing claims as referred to in Articles 77, 78, 79 and 82 of the GDPR on behalf of the natural persons concerned?










2.


Are the admissibility requirements in the WAMCA, in particular with regard to similarity and representativeness, permissible in the light of Article 80(1) of the GDPR for representatives who wish to bring a collective action for damages on behalf of data subjects against a controller or processor for infringements of the GDPR?










3.


Does the requirement in Article 80(1) of the GDPR that an interest group be active in the field of protecting the rights and freedoms of data subjects in relation to the protection of their personal data go further than, or differ from, the national requirement that the interest group have sufficient experience and expertise with regard to the procedure to be followed (Article 3:305a(2)(e) of the Burgerlijk Wetboek [Civil Code] [BW]), in conjunction with the requirements for the Articles of Association (Article 3:305a(1) of the BW)?
Does the activity requirement in Article 80(1) of the GDPR mean that the interest group must have a track record?










4.


Do the concept of ‘mandate’ in Article 80(1) of the GDPR and/or the provision of Article 80(2) of the GDPR preclude national legislation under which an interest group that meets the requirements of Article 80(1) of the GDPR may bring a collective claim for damages on behalf of data subjects against a controller or processor for infringements of the GDPR, even though that interest group has not been instructed to do so by the data subjects?










5.


In the context of question 4, when interpreting the concept of ‘mandate’ in Article 80 of the GDPR, to what extent is it relevant that, under national legislation (the WAMCA), the data subject is not required to indicate in advance that he or she wishes to be bound by the collective action for damages? In addition, he or she may (where applicable) choose in writing at two points in time not to make use of the representation by the representative and therefore not to be bound, namely (i) within a period to be determined by the court from the moment that the representative is appointed by the court as (exclusive) representative (Article 1018f(1) of the Wetboek van rechtsvordering (Code of Civil Procedure) [Rv]) and (ii) within a period to be determined by the court in the event that the parties have concluded a settlement agreement (Article 1018h(5) of the Rv).






(1)  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; ‘the GDPR’) (OJ 2016 L 119, p. 1).


ELI: http://data.europa.eu/eli/C/2025/5934/oj
ISSN 1977-091X (electronic edition)