New York Court Is the Wrong Venue for UK GDPR Class Action–Finch v. Xandr

December 17, 2021 · by · in Licensing/Contracts, Marketing, Privacy/Security

Maybe I’ve missed other cases in this genre, but I don’t recall seeing them. Xandr self-describes as “the only open, end-to-end platform for scaled, sophisticated campaigns on premium inventory across screens on premium inventory from CTV to data-driven linear and much more.” 😶 “Xandr is a wholly owned subsidiary of AT&T, Inc. It is incorporated in Delaware, with its principal place of business in New York, New York.” It appears to be the consolidation of AT&T acquisitions AppNexus and Clypd.

Xandr places third-party cookies and uses it to track users and collect personal information about them, which it then shares with its business partners. The plaintiffs claim this activity violates the UK GDPR. “Xandr does not dispute that it is subject to the UK GDPR or that cookie IDs are personal data under the UK GDPR.” The UK GDPR authorizes private rights of action in US courts.

The plaintiffs sued in the Southern District of New York. Xandr moved to dismiss on procedural grounds.

Venue Selection Clause. Xandr’s TOU has a mandatory venue clause specifying New York courts. This puts the parties in a weird position: the plaintiff is arguing for the TOU and the defense is arguing against it.

The court says the claims aren’t governed by the TOU. First, “the forum-selection clause applies only to claims that concern the Terms of Use. Accepting the facts as alleged in the Complaint, Xandr’s actions did not violate or implicate the Terms of Use found on its website.” Second, the named plaintiff never went to Xandr’s site and never saw the TOU. Third, the TOU says that Xandr only provides its services to people located in the US; “Those who choose to access our Site from other locations do so on their own initiative and are responsible for compliance with local laws.” I know many TOSes contain similar terms, and I’m always confused what problem they solve. In this case, the court cites this provision against Xandr, so whoops.

Forum non Conveniens. The court evaluates a balancing test and concludes that the UK is the more appropriate venue than New York.

  • “Finch is a foreign plaintiff bringing claims on behalf of an entirely foreign purported class, based solely on foreign law. The litigation’s only apparent connection to this District — and to the United States — is through the defendant.”
  • “Xandr consents to be amenable to service in the United Kingdom, and there is no question that the United Kingdom permits litigation regarding the UK GDPR”
  • “the public interest in having this dispute adjudicated in the United Kingdom is especially great, as the Complaint presents novel questions regarding the UK GDPR. It is in the public interest that courts in the country of enactment interpret the law in the first instance, in a trial setting where affected members of the public can easily attend and observe.”

So the case is out of the US. The plaintiffs can refile in the UK if they choose.

The court didn’t address the obvious question: given that this is a UK law, why did the plaintiff want to litigate in the US and in Xandr’s home court? I’ve speculated on a few possible hypotheses:

  • maybe the plaintiffs fear that Xandr will contest jurisdiction in the UK? This issue should have gone away when Xandr consented to service.
  • maybe the plaintiffs are trying to avoid the UK’s loser-pays attorneys-fees rule?
  • maybe the US rules for class formation are more favorable?
  • maybe the US court will be more pro-consumer/less business-tilted than UK courts?

I also invite your speculations about why the plaintiffs chose to litigate in the US and are fighting to stay here.

Case citation: Finch v. Xandr, Inc., 2021 WL 5910071 (S.D.N.Y. Dec. 14, 2021)