GDPR class action lawsuits against Oracle and Salesforce worth €26bn

Intro [Music] hey you born welcome back to the information security stack together with me dorian gosselson and kim hindert today kim we have something really nice to talk about class action lawsuits finally they're here awesome it's actually happening it's currently two it's one case but it's driven in two places one in the uk and one in the netherlands and it is regarding oracle and salesforce and the class actions lawsuits are absolutely enormous not per person in itself is like 500 pounds or 500 euros per person which in itself is a nice little bonus to get if you're just doing nothing and you get 500 pounds but in the grand total of things because this is uh regarding so many people we're talking about a fine roughly 10 billion euros in the uk and an additional potential 15 billion euros in the netherlands now that's a boatload of cash finally because i've been saying all the time it's not the administrative sanction fees that you need to worry about from the dpas no they're the small part of it it's the class action lawsuits and what is the reason for this class action lawsuit because they made tracking cookies so we will talk about this don't record people's behavior as soon as you do the least bit of recording of user behavior on your in your app on the digital world in any sense you will end up with personal data faster than you can say whoops yeah so for the reason don't track user behaviors without their consent without their informed consent yes Why do people track your data why do people track this anyway well i mean for the first and foremost it's because you can make cash out of it it's it's very financially positive if you have that as a business model meaning i track your behavior i can now target um i can target uh commercials i can target products i can target sales i can target you as the person because i now know what you like what you don't like where you where you serve to which sites so on xyz let's just realize this is the new gold it is this is the new oil yes there's it's not banks that's the major corporations today it's not oil companies that's the major corporations today no the 10 biggest companies today it's tech tech tech tech yes yes tech and well the reason is gdpr doesn't prohibit you from tracking user behavior not at all it just makes it regulated so you can't do it without the user's informed consent and you can't abuse that right no without the user having the opportunity to say no i don't want you to sell my personal data for a profit without my knewing no so for profit sales of human in a personal data well we're back to slavery yes without the hard labor it's human trafficking but it's still human integrities we are violating because yeah so that's a bad practice we have a major case in sweden as well with the insurance company that did this that they actually reported themselves yes later oracle and salesforce same they don't nothing wrong yeah so so yeah so in in this case with the the whole sales force and that bit is that they have not self-policed this is now a claim against them it's it's it's a it's a it's a it's a lawsuit against them and if you imagine that for doing something violating your personal integrity i mean 6 000 swedish kron or 600 euro yeah well the transgression doesn't have to be that huge actually to warrant that no Free services are like human trafficking and if you do it to billions of people guess what you end up with billions of fines yeah as well so because here here we come back to the fact that we've been talking about in in in earlier sessions is if if you use free services on internet nothing is free you're paying with something probably your integrity so but still it's a it's a free service and then you kind of know you're probably getting screwed you should know at least you're probably getting screwed but in this case i'm paying for a service i'm a paying customer i'm a customer i'm paying you for the service that you provide and you say here's my perfect service it's awesome and i put and i purchase it and we have an agreement in place i hopefully have read the the contract in detail so i know exactly what i'm buying and then you decide to just make profit out of of my uh i didn't identity just because you feel you want to make another profit so my the profit gain from me purchasing your service wasn't enough now you take my identity and you sell it again and again and again for a profit that's a business model and if that's the case not only are you fooling and uh you know you're using you're using your users essentially that's what you're doing and you're not being upfront and honest about it it's illegal it's to your point it's it's like human trafficking you're selling another person to a third party this is exactly why gdpr wanted to open for this opportunity so yes so hopefully we will see a lot more class action lawsuits but unfortunately there's a lot to people just they just don't understand this because they haven't read the agreements properly no they haven't seen to the agreements to understand that the tech giants [Music] really really want to gather analytics on user behaviors yes sometimes i'm pretty happy that we're too small to benefit from that because we haven't this huge ai engine so we can just survive by we it's no use to us anyways we don't do it no but you shouldn't do it at all no and the the sad part with this is if you just do it openly and make a revenue cut if you earn a lot of money from this if you push that back to the user you would have millions and millions of volunteers The sad part who would happily provide all their user behavior for a few bucks right so if you're open about it and you're telling me that this is the way we do business and if we do that and you i mean me allowing you to do it i get something back for it yes you would have millions so you wouldn't even you don't even need to waste anything like this you don't need to do it secretly but what is the reason and why why this is i mean to be honest what we're seeing right now is a wave of companies getting caught yes that's all there is to it because it's been pretty much common knowledge for a long time that this has been going on and the sad part is it's just because they haven't adapted to gdpr yet no they they've just just Will GDPR go away ignored udpr it's been a bit of visual thing thinking if i close my eyes yeah and wish really hard then gdpr perhaps goes away no it won't no so all right so if we're going to give ourselves some credit here let's do that a couple years ago when we ran a swedish podcast called gdr podcast in sweden it was only swedish unfortunately but at the time this was 2016 2017 two two and a half years before the entry of gdpr you were a big spokesperson of these types of lawsuits and you said now finally we have a rule in place which open up the potential now we didn't think it would happen every week but at least now you have the potential for for these types of lawsuits and most people that a heard that or b listened to was or c said well that won't happen and in sweden and in europe we have a history of not using these types of class action lawsuits it's just not a thing in the us it is a thing it's a massive thing it's ginormous fines which has been going on forever it's almost stupid in the other way because the fights are so heavy it's no one can get paid but that's that's not getting into detail but four years ago you said this will start to happen and it took about four years because here we are late 2020 and we're seeing but finally it's happening it is and Class action lawsuits sanctuaries will be nothing really nothing in comparison to the class-action lawsuits depending on transgression you do and how many usage it tarps yeah so we have cases actually established cases within europe right now of a single happening for a single user where it's been determined that sensitive information leaking for a single user was worth around 30 000 euros imagine if your entire database of users when you took millions of records yeah that's 30 000 per individual because each individual heart have been hurt just as much yes so when you are breaching or giving away or selling away yeah millions of records now you're in trouble yeah because all their all the people in those records have an equal claim yes if they have been equally hurt or potentially equally yeah and then all of a sudden now you have you have a difficulty and people say yeah sure but this is just oracle and salesforce yeah but we have a lot of european companies a huge amount of companies using salesforce yes and what happens to them go and read your contract really really well go and read your contract because you will help be held responsible for any class action lawsuits against your company just by using salesforce so even if it's salesforce that's abusing this you might be held responsible towards the data sub and this is a tricky part because you might not get any any help from salesforce in that end no you're on the risk of being on your own depending on the contract yeah so every company using oracle salesforce go and look at your contracts really really well and this goes for all the big tech companies that earn money and profit on making analytics out of user behavior if you contract google if you contract microsoft if you contract oracle if you contract facebook if you contract any of the big users hyperscalers pretty much make sure that the contracts list what are they in intend to gather for out from analytics point of view and how are you using it because let's understand Personal data if we are gathering human behavior you will end up with personal data immediately end up with personal data no doubt about it so if it comes to something something user behavior at all make sure you have really really solid on what does the contract say how are they allowed to use this and how can you control it otherwise you might end up being the one sued in the class action lawsuit you're on the risk of it yes and you won't get any help from salesforce and you know even though if you haven't done anything wrong or whatever you have to fight off the claim and that in itself is expensive yeah it takes time and it costs a lot of money money and once again keep in mind the actual definition of what a personal uh information is regarding to gdpr it's anything that can relate to a living human being one soul so anything essentially could be and yeah that's tricky and we can we can go into to order to nitty-gritty something i could then identify you and especially the case in point with salesforce and oracle yeah they kept tracking cookies so not only was it what i did on their site yeah they kept tracking my entire internet yes so everything yeah everything so everything i do so now we end up in sensitive data immediately yeah i go to subscription pages i go to medical pages i go to dating sites that might be gay dating sites all of a sudden we are right in the middle of sensitive yeah i mean sexual orientation uh any union related info whatever it might be organizationally info files philosophical beliefs yes pretty you can determine that pretty Browsing history fast just by looking at people's browsing history yes today yes the rest of the shows i mean that's all you need to look at what do you actually browse to what you like what you don't like what are your personal preferences for anything in life yeah well you know my browser knows my interest very very well oh for sure so and they might be both sensitive and they might be they might be a little bit you know might not be something you want to be public about but they know it and if that's the case once again coming back to the fact that i have an agreement with a company which then takes my identity and uses that for personal gain monetary gain that is an issue and that is uh and like the privacy wardrobes that have actually filed this class action lawsuit i do hope this becomes a lot more common i hope so as well because then it will be a lot rarer that they start abusing this one would hope anyway yes so but once again coming back to this is this is these types of cases is essentially what x what gdpr was made what what the reason why what it exists it's this is why and unfortunately you you know we talked about this you know during during lunch today essentially that this is just gonna keep coming up and popping up this is not the first and this and this is not the last case we see in these types of regards they're just gonna be more and more and more because there are it is a behavior within tech companies today unfortunately a majority of them has a history where it wasn't it wasn't a problem no one cared essentially but now it is a problem people care and if you don't change that behavior you will be caught and here we are and the objections you see from the big tech companies that's crying are rivers yeah i mean yeah exactly the same was the banking said that yeah exactly the same all companies said about polluting yes we can't be held responsible for polluting well yes you can because you're polluted you're the one making huge profits of this yes yeah sure you can yes you can it's absolutely correct and guess what they became regulated yes and we're gonna say this we're going to see the same pattern here for sure and it should be regulated yeah so yeah and i mean essentially since everything today is internet-based yeah and before you start claiming that i'm no no no totally socialist no i think that you should have free competition as much as possible yes but some things should be regulated yeah and yeah you should be held accountable Being held accountable for not violating people's integrity yeah and if i claim i do one thing and then i do something completely opposite then i'm lying yeah and if that lie turns into a crime the you know guess what you should be fine for it yeah there's always to it so we can all agree that even though there would be a great uh market for it slavery is not something we want to do no not in any way shape or form and yes you can claim that that is a very harsh comparison but think about it just think about it it's people's integrity it's people's digital identity yes that you're trading away yeah without them knowing yeah for monetary gain guess what yes but it's pretty much the same thing but just to understand it takes very very little of what you're doing and what you're gathering from your user behavior before it starts to become sensitive as well like i said tracking cookies but imagine insurance companies sells insurances in sweden we have discounts for insurance as if you're a union member of a union all of a sudden you register union membership the same way yeah all of a sudden now you're sent right into sensitive data literally name sensitive data in gdp or they tell you a union membership is considered sensitive data yeah so it's it's it's so easy to get there and it's it's faster you have special insurance if you're pregnant all of a sudden you're right into medical conditions yes so i mean so it's just the step the small step into to chapter 9 of gdpr is very easy so if you're not careful you will end up there faster than you can say you yeah and when we get there all of a sudden when insensitive data all of a sudden it's going to be considered a major breach a lot quicker as well and then the fines are heavier as well and not just the fines the lawsuits are going to cost you a lot more yeah all right so once again now this is this is the first big one we see at least in europe and uh we are pretty certain this is not the last one there will be more yeah all these types of class action lawsuits and it's the lawsuits that will hurt the most and if for no other reasons there are lawyers out there who see a monetary profit yeah the lawyers cannot rise so but to all you european ambulance chasers go right ahead chase the ambulances this is something you should we should chase away this is a baby we won't want to so go ahead sue uh sew away more of this good good for you go sue sue them go lawsuits yeah but it you know what it but it is such a different behavior we're not used to this we're not used to this and i i don't think the users in itself us us the users mean us the public really understands our own rights in this as well but as soon as someone can tell you you can get a few thousand euros without doing any effort just sign here yes yeah oh absolutely do you feel hurt yes i do sign here and just understand that the biggest of these companies that do these type of transgressions well this is not companies that you sympathize with and say oh poor you oracle says i don't know your relation to them but if they can pay me 500 euro without me doing something yeah i will take the 500 europe please the only thing i don't like about these class action laws is to your point i can sit on my couch and just make money yeah by making myself a victim yeah and we have a victim culture in this world which i'm not a really huge fan of to begin with so no unfortunately that it could foster more of that but it should in in the cases whether is uh when actually someone has gotten hurt i'm all in favor for it uh and i can say oregon says for sorry mates i will take 500 euro from you and the day of the for this yeah if this is true yeah i would take this so hand me the money yeah so yeah so i mean so this is the tricky part true no you might end up with in trouble but what i warn uh a warning to all companies out there using salesforce yes you might be held accountable for this i know a lot of telcos in sweden are are fans of using salesforce yeah well go read the contract i'm saying go and read the comments an extra way because yeah see what is actually true for you it might differ so we're not gonna we're not gonna make a broad brush for everyone here but we just but i say it's well worth looking into your contract with that for sure so this is going to happen and we will follow this case very intensely because it's very interesting uh and once again as we mentioned before we think it's going to be more of these types of claims in the future yeah and rest assured we might end up not following this case anymore because tomorrow there will be five new ones right so yes clear probably someone else but uh yeah it's i i think it's going to be a trend we will continue to watch these uh these cases as they move along and we'll keep you updated with our point of view and if you want to participate ask questions or you want to be involved in this podcast feel free to contact us at citynetwork.edu podcast where you can answer ask answer well you can answer questions yourself if you want to but you can ask primarily questions or you can ask if you want to participate so please do that until next time take care you