An investigation by a Dutch journalist discovered that during Covid-19 testing and vaccinating, thousands of call center agents had the ability to bulk download the sensitive information of 6.5 million Dutch citizens. This data was sold to cyber criminals.

In this situation, the government took a risk and ignored warnings about the potential for this private data to be misused. There should have been better monitoring of who had access to this information. The ICAM Foundation is an independent, non-profit organization that has set up a collective action to stop this data leak and preserve the privacy of the victims.

The challenge of this collective action was to gather enough participants to pursue collective litigation and effectively manage them, in a cost efficient way.

Since this was a collective action related to a breach of privacy, it was extra important to make sure we limited the use of personal data while bookbuilding. We wanted to collect only the information necessary and make sure participants understood exactly how their data would be used.