Netherlands Privacy Class Action

On August 14, 2020, The Privacy Collective (TPC), a foundation having its registered office in Amsterdam, filed a purported class action lawsuit against Oracle Nederland B.V, Oracle Corporation and Oracle America, Inc. (the Oracle Defendants), Salesforce.com, Inc. and SFDC Netherlands B.V. in the District Court of Amsterdam. TPC alleges that the Oracle Defendants’ Data Management Platform product violates certain articles of the European Union Charter of Fundamental Rights, the General Data Protection Regulation (GDPR) and the Dutch Telecommunications Act (Telecommunicatiewet). TPC claims damages under a number of categories, including: “immaterial damages” (at a fixed amount of €500 per Dutch internet user); “material damages” (in that the costs of loss of control over personal data should be equated to the market value of the personal data for parties like the Oracle Defendants); compensation for losses suffered due to an alleged data breach (at a fixed amount of €100 per Dutch internet user); and compensation for the costs of the litigation funder (10% to 25% of the compensation awarded); and the (actual) cost of the proceedings and extrajudicial costs.

We filed our defense on March 3, 2021, and on December 29, 2021, the District Court issued a judgment, holding that all of TPC’s claims were deemed inadmissible because of fundamental procedural flaws. TPC filed an appeal with the Court of Appeal in Amsterdam challenging the District Court’s judgment, except for the claims regarding the alleged data breach, which were dropped. On June 18, 2024, the Court of Appeal overturned the District Court’s decision regarding admissibility, thus permitting the case to proceed. We requested that the Court of Appeal permit an interim appeal to the Dutch Supreme Court and/or the European Court of Justice. On September 24, 2024, the Court of Appeal issued a judgment confirming that TPC’s claims are admissible and referred the matter back to the District Court of Amsterdam for a decision on the merits of TPC’s claims, including TPC’s claims for damages under article 82 of the GDPR. The Court of Appeal also granted Oracle’s request for an interim appeal to the Supreme Court, appealing the June 18 and September 24, 2024 judgments.

Oracle filed its statement of appeal with the Dutch Supreme Court on December 20, 2024, and TPC appeared in the proceedings on January 31, 2025. The filing of the Supreme Court appeal effectively suspended proceedings before the District Court pursuant to applicable procedural rules. TPC filed its statement of defense in response to our Supreme Court appeal and a counter appeal on February 27, 2025. Oracle filed its statement of defense to the counter appeal on March 28, 2025. TPC and Oracle are to file written submissions setting out their detailed arguments on or before July 18, 2025 and to file their respective written replies and rejoinders on or before August 29, 2025.

We believe that we have meritorious defenses against this action, including defenses to the quantum of damages claimed, and we will continue to vigorously defend it.

While the final outcome of this matter cannot be predicted with certainty and we cannot estimate a range of loss at this time, we do not believe that it will have a material impact on our financial position or results of operations.

Other Litigation

We are party to various other legal proceedings and claims, either asserted or unasserted, which arise in the ordinary course of business, including proceedings and claims that relate to acquisitions we have completed or to companies we have acquired or are attempting to acquire. While the outcome of these matters cannot be predicted with certainty, we do not believe that the outcome of any of these matters, individually or in the aggregate, will result in losses that are materially in excess of amounts already recognized, if any.