Rebecca Rumbul is bringing a class action suit against Oracle & Salesforce to court, why?

now that we're officially in the run into Christmas why not think about giving a gift with a story behind it alive and kicking are using football as a Force for good and helping to support mental health education across Africa you can do the same by giving someone a football from alive and king.org sshop now the footballs come in retro 90s kit designs so go have a look and give a unique gift that will help make a huge difference to more than just the person who receives it this [Music] Christmas and whilst Oracle and Salesforce by no means the the only or the worst offenders in terms of putting these cookies on your system um they are the ones that I think are probably most prevalent so I think they're the ones in terms of volume doing the most damage to the most people on today's Tech talks we are getting more top topical than we often are by talking to Rebecca Rumble the head of research at my society and an individual bringing a class action legal suit against Oracle and Salesforce taking them to court for breach of gdpr in relation to ad Tech business this is Tech talks your twice weekly technology podcast with myself David Savage today joined by Haley Welch where we interview leaders from across the industry and bring you some technology news enjoy the show so on today's show I'm joined by Haley how are you this morning very very well thank you how are you yeah good I mean it stopped raining for the first time it feels like in several days and although I did go for a walk in the rain yesterday that was quite nice that's quite a odd thing to do is it no I guess it's not but it's wouldn't it's not a preference well you know I thought just get out of the house go for go for a quick stroll down and get a coffee and actually yeah it was raining but you know when it's not like throwing it down and it was kind of quite nice in a random way but yes no it was quite nice getting out this morning bright Sunshine the leaves are I do like Autumn I won't I won't lie I like Autumn I genu generally I don't really mind all times of year but just like the bit between summer and Christmas I find sometimes a little bit depressing and then late January February late January February is rubbish I thought so really bad yeah let's let's make not no pull no punches about that all the lights have come down it's dark it doesn't really get light again until end of March early April the weather's rubbish it always seems to fall off a cliff in like February March and get really cold and really yeah literally no Christmas spirit to keep you going I know it's just useless anyway uh it's not that time of year yet so let's enjoy Autumn when the leaves are all very nice whatever else um you know what I'll still be going on by the time that we do get round to that time of year yes I do a class action lawsuit against Oracle and Salesforce in fact it'll be going on next Autumn at summer winter spring for several more years as we are about to discuss because our guest today is Rebecca Rumble who is head of research at my Society she is bringing a class action legal suit against Oracle and Salesforce I am going to hand over to the interview and then myself and Haley will have some commentary on it afterwards so today I'm joined by Rebecca Rumble uh Rebecca you are head of research at my Society you're also a council member non-exec director of the advertising standards Authority thank you for taking some time to have a chat to me today thank you for having me how are you good thank you it's a beautiful day well I don't know about that but compared to how it's been over the last few days the first winter storm and all that um yes look thanks than for your time you're here today to predominantly talk about a a legal issue a court case that um you are going through at the moment before that do you want to explain what your job is and uh and talk a little bit about uh your your role with my society and then we'll move on to onto the kind of the the meia subject for the day sure so as you said I'm head of research at my society and that's a little organization that a lot of people will not have heard of um but we are one of the global leaders in the Civic technology space so we try and build Tech that in some way uh empowers citizens and and helps them to uh to communicate with institutions governments parliaments and get things done um I am as you said also on the board of the advertising standards Authority regulating advertising in the UK um so I've got quite an interest in Good advertising and bad advertising uh and I previously uh worked at the information Commissioner's Office many years ago uh in data protection so I've got a real interest in uh data and privacy as well so do you want to talk us through what it is that uh you were you were predominantly coming on the show to talk to us about because I think I think if I try and paraphrase it first I'm likely to get this horribly wrong so yes so uh in addition to my day job um I am also currently uh the lead representative claimant for a very large class action uh type legal suit against Oracle and Salesforce in the UK um not necessarily household names but anyone that has an interest in Tech I'm sure will know those two names yeah I mean I don't know they are they're organizations that people will are likely to have heard of big in the tech world I think anyway so yeah I I am taking these uh two organizations to court um for breach of gdpr essentially um and this relates to their ad Tech businesses so even though they are both huge concerns with lots of fingers in lots of different pies um we believe that their adtech um does not uh fit under gdpr regulations I don't believe that they really meet their obligations in terms of consent um and tracking uh with their cookies by these two what is it about Oracle and Salesforce that has prompted you to take on frankly two two large organizations with very Deep Pockets so advertising cookies um as many people know are pretty pretty pernicious they they collect an awful lot of data that I'm not as I say I'm not convinced that that we consent to to them collecting and then selling on um Oracle and Salesforce went out and deliberately bought uh this kind of adtech uh in the last 10 years um blue Kai and Crux uh you know this was a conscious decision to go out and spend millions and millions on um acquiring these kinds of massive data Hoovers um and whilst Oracle and Salesforce by no means the the only or the worst offenders in terms of putting these cookies on your system um they are the ones that I think are probably most prevalent so I think they're the ones in terms of volume doing the most damage to the most people um I think in in terms of like the top thousand websites in the UK um one of these cookies you'll probably um be getting them from I don't know about 30 or 40% of those websites so it's likely that an awful lot of people are affected so yeah they've got very deep pockets they can you they they have the legal ability to respond to this kind of uh claim and you know they have potentially the ability to to compensate all of us that that feel that we've been taken advantage of So when you say taken advantage of let's let's roll this back for a minute because I think the most of our audience would be familiar with it but I I've worked in tech for a long time I get adtech we've had adtech organizations trying to put power back in people's hands on this podcast over time when I go onto a website I probably still click allow cookies I without reading policy because I'm just navigating Around the Net and I'm trying to get information and I'm trying to get on a particular website or whatever else and it's just like yeah whatever I I mean I know that my data is everywhere and then if it's everywhere then what does it matter if it's a little bit everywhere else right and I do the same because and but that's what that's what these people want you to do you know th this is designed so that you can very very quickly just get rid of it and go about your business um and and think nothing of it um why isn't it the other way by default default why isn't it opt out by default you know why is everything opted in by default the you know I I I do the same I'm harried I'm in a rush I just want to check something oh God the cookie banner yes yes yes um and I don't know if you've ever tried to actually go in and and change your cookie preferences um on some of those things instead of clicking accept or but you then get presented with lists of things that you have no idea what they are um you know it might M it might make sense an analytics professional um but you know you end up having to tick or untick 20 or different things that don't really make any sense to a normal person anyway you know you'll end up rage quitting after a while and just going back and accepting all anyway just because you just W to you know you just want to get the brownie recipe you just want to read the news you just want to check if your flight's on time um and yeah I I believe that the you know these cookie banners that they're designed this way to to make us just think oh you know forget it fine whatever I I haven't got anything to hide um oh my data is out there anyway but that's not that's not a great way to think about it I mean what what would you say to people then that you mentioned there why is it op why is it opt in why can't it be opt out you know all these organizations likely to do that are they going to turn around and go right here's a really laborious way of going about this that most oh God yeah just go back to kind of what you know what what are you what are you trying to achieve in that regard so I mean ideally adtec would not rely on just indiscriminately hoovering up every single piece of data that they possibly can this is not this is not a great way to live you know the these these data points are used to make a very very detailed profile um and it's not just held by one place it's it's being auctioned off to to put other adverts in front of you you have no idea where those profiles are going you have no idea how secure where that data is being held is um you know data breaches aren't exactly unusual um even if you don't have anything to hide there's a reason why businesses are spending so much money and spending so much effort trying to get that data out of you um so yeah there is there you know there's a big bigger consideration there um and what I'm not advocating for is huge cookie you know huge banners where you have to endlessly click everything before you get to you know the chocolate brownie recipe or whatever that you really want to see I mean ideally what you'd want is more contextual advertising that is related to what you're act you know the page you're actually on what you're looking at so if you are looking at a cookie brownie brownie recipe you know there might be advertising for cookware on that page for instance you know harking back to when actually advertising was a lot more interesting I mean I remember I I like like good advertising I this is one of the reasons I enjoy my role at the advertising standards Authority um advertising Le days is so lazy online because it is it's based on this just hoovering up of all of the data and you know the highest bidder just shoving an advert in front of you normally something that you've already looked at but it really wants you to buy it so you'll get that advert for the next two months until something else latches on um that's I mean I think that's lazy advertising anyone I don't think anyone enjoys that um but yeah more contextual advertising that's relating to actually what you're looking at online anyway rather than just random things that are being pushed at you and what what is your argument then to Oracle and Salesforce how where are you out in the process what what what pressure are you hoping to put on what what's the outcome I suppose that you're hoping to achieve because financially or not it's not this isn't about money even if you win this case as far as I understand it's not like you're going to get a big pot of money that you can do a huge amount with and these organizations will still have a lot of money so of course of course um no I at the end of this I will not be walking away with a large check in my pocket I will basically get the exact same amount as everyone else that's affected I am I am bringing this suit on behalf of everyone in the UK that is affected um and you'd argue as anyone who's online yeah is anyone online who's had one of these cookies put on their browser I suspect if you use a crown uh sorry a Chrome browser uh you will probably have at least one of these cookies on your system um and what we're going for is you know maybe around 500 pound per person because these cookies have been hoovering your data up packaging up that information and and selling it off to the highest bidder which I believe is without the consent of of the people that click clicked accept all um so yeah we you know no one's walking away May having made a lot of money out of this um but between the suit I'm bringing here and a parallel suit that's being brought in the Netherlands um who I'm Who I'm working very closely with uh combined that is about 10 billion euros um that's the largest case that's ever been brought under gdpr the largest value case uh to date um and that sends a very prominent message you know that that's yes Oracle and Salesforce will certainly financially surv uh having to pay that out if we win um but it sends a very strong message to the whole adte industry that actually this will not be tolerated anymore this this Behavior will not just be kind of ignored as oh okay well just just the cost of the internet and how it works you know hopefully if the decision goes our way then the ripples will mean that the adtech industry actually adopts you know less egregious approaches um to using and processing data you've got your your education is kind of philosophy and politics and it's not legal no and you're taking on as we've said large organizations who will have a lot of legal clout to bring to the process Playing devil's advocate for a minute say you lose problem doesn't go away so what do you then advise to me other people listening to say well look didn't beat them in court but here are some steps that you can do to actually protect yourself okay um there are many steps you can take um the downside of that is that privacy online is exhausting um it it takes an awful lot of Will and energy um to to Really protect your privacy online I would say with the cookie situation you know do click actually no you know go into go into the pref refences and say no I don't want all of these cookies um clear cookies off your browser periodically don't let them sit there forever um but also there's a there is a legislative element to this it's something that I think regulation in the UK has not really caught up to to where we actually are at the moment um regulation always tends to be years behind Innovation it's it's the nature of things but you know the Ico I think last year put out a report on adtech that recognized that there was probably things going on here that weren't okay um but that they didn't have quite the resources uh to to look into it with enough kind of granularity at that point um Parliament is in is increasingly looking at how data is processed as it should be um not just for for Pure advertising but the other kind of you know advertising online as well and how data is processed so again you know if this is something that concerns people they should also be doing you know really kind of quaint old age things like writing to your MP and saying this is this is a problem you know you should be looking at this at a more kind of structural level rather than relying on in you know individual independent citizens being able to bring these kinds of large suits because whilst that is you know this is a good thing it's one way for me to try and change the the behavior of these companies you know this is I'm I'm relying on other people's money to do this so you you obviously work for the advertising oh sorry no you advise the advertising standards Authority um you're talking there about the legal lag you're talking there about putting pressure on government um up until a few years ago or sorry over the last few years rather we've been talking to dot everyone which was marthain yes for policy body until it was Amalgamated into the idol love lace Institute um and they were advertising for an independent regulator is that something that you think we need to continue to lobby for is it is it going to be something like that kind of a body that can hold big Tech to account as opposed to individuals or writing to MPS and so on because that that realistically is that kind of level of coord coordinated effort is going to take a hell of a lot of um of of of creative uh organization I suppose to to get that to actually have an effect right yeah totally they're definitely needs to be better regulation somewhere uh whether that is in the form of a new regulator or whether that is that is in the form of beefing up um the remit of the information commissioner's office um I mean again this this is one of the problems you know the internet is still a bit of a wild west in terms of Regulation and how you chop things up it was very easy 20 years ago to look at regulation say Okay data protection sits over here um ad ading regulation sits over here um election uh regulation sits over here but increasingly online they're all interconnected and they all depend on a lot of the same technology um it it needs to be very well thought out I'm not saying that a new regulator is necessarily the right way to go it might actually be making existing Regulators a bit more integrated in terms of some of the tech that they're looking at um but certainly yeah we we don't currently have a regulatory framework I think that's appropriate um for the for just you know the level of data integration in terms of our personal and public lives so how how long is this process gonna take I mean Christ if I think of somethingone like Aaron Brockovich and like it to to a class action like that and it's mountains of paperwork and it takes months and you know where are you at in the process when are you likely to find out whether or not you're you're even part part way to being successful well we're not so retro as to be using too much paper these days we are saving the rainforest by doing it is I I thoroughly enjoyed it um it's G to take ages um you know the mechanisms of of Justice do not go very fast um one thing we are very much waiting on with B you know waiting very eagerly to hear is the outcome of the Richard Lloyd V Google case um which I don't know if your listeners are aware but that is that refers to um a workaround uh Google basically installed a little back door in the Safari browser um I think it was about 2011 um so he is actually in the middle of bringing a very similar kind of class action in the UK um there have been a couple of decisions it's now being battered to the Supreme Court for a final decision on the ability to actually bring a class action because class actions are very very new in the UK we haven't really had a history of doing them at all here like in America um so we're waiting on a decision on a point of law in that case before we can really kind of proceed full steam ahead um so we're at the very beginning here we are filing officially very very soon you know we've obviously notified Oracle and Salesforce that we're bringing the claim um but yeah it's going to be a long process I I'll be quite happy if we manage to get it to put to bed within three years the world will look different I suppose data and advertising May well have moved on think about the way the world's changed in the last six months never mind yeah three he years uh okay last last quick question then look if if someone listening and obviously we do have a tech audience so this isn't going to be kind of holding new territory to them but if if they feel strongly about this is there any way for someone listening who wants to help to to get involved absolutely um please reach out to me I'm on Twitter um at Rebecca Rumble um the Privacy Collective which is kind of the umbrella brand that I'm working with to to bring the claim in the UK and and with our colleagues in the Netherlands um they're on Twitter as well we'd love to hear from people we if people want to help or if they've got information or advice or you know they just want to show their support if they can click on the show your support button on the Privacy Collective website that actually is really useful for us because it enables us to demonstrate to the judge that other people actually believe that that we have a case as well um so yeah support is really really important to us um we'd be very happy to receive any I should point out when you say you're at Rebecca Rumble if anyone types in Rumble as you might imagine it's spelled it's Ru M bu L it is I'm sorry not quite let's get ready to rumble look um Rebecca it's been lovely to speak to you today obviously a really interesting case um and one that we will keep an eye on I I wish you the best of luck in making sure sure that you do draw attention to this because it is obviously something that's affecting everybody especially the more time that we spend online as a consequence of the pandemic so uh really interesting to chat to you today and good luck awesome thank you very much when I was talking to Rebecca and I said I just kind of click on cookies and I don't really care where my data is I said that very genuinely but what she said also resonated in terms of the fact that whilst I don't whilst I don't care that I'm giving my data to get access to various information online it does bother me that then it's not all held in one place and it's auctioned off and you have no say who your data is being sold to and why I know and I don't actually think I mean the majority of people who work in technology and things like that I think that they would understand what a cookie is but I think a lot of people aren't aware of what they are what they do that you're data is getting pushed off to whoever um so it's a bit worrying isn't it when you think about it like it's probably a bit like when you when you download something on Apple or whatever and you've got the term you you know you get the updated terms of service or whatever and you just click yeah yeah yeah yeah you don't really think about it right you don't read them no way we're way we're in impatient Society we just want to get on the web page and cookies are probably held in a it's probably thought of in a similar Way by most people right 100% yeah I heard cookies and brownies a lot in that podcast by the way and madebe hry I think yeah mishearing browsers as brownies is is an indication of of where we're at in in kind of the weather getting a bit colder and it being like um yeah yeah certainly cookies triggering that um yeah uh and the brownies recipe yeah yeah it's bad it made me think of bake off as well which was all about Tray bakes last week anyway that's going off on a random topic yeah I feel slightly naive I know of both Oracle and Salesforce Haley our office is in the Salesforce Tower so exactly we'd be mad not to know much about Salesforce I didn't really realized that it was as pernicious as 30 or 40% of the top 10,000 websites that their business had stretched into that I kind of thought cloud computing and I thought of uh um software as a service on platforms for sales tools not advertising on 40% of the the top 10,000 websites yeah I think that it's an eye opener it makes you think these big companies have got their fingers in many pies and also like when you think of Salesforce and you think of Oracle you actually think trusted businesses yeah and we need people like Rebecca basically keeping their eyes out for this sort of thing because otherwise this thing's going to be going on behind closed doors and makes you think how many other businesses are doing similar things um and she actually mentioned didn't she like would be a riet effect of other companies maybe thinking oh maybe we shouldn't do that anymore yeah yeah and look she she mentions um Richard Lloyd versus Google at the end of the podcast interview and you're right you know I I I I think of Salesforce and for some reason I think B2B company therefore probably exploiting me less which is Perhaps Perhaps really naive because I would think Google Apple yeah Facebook uh absolutely Facebook um in particular as being those kind of big tech companies that I have to be a bit wary about yes can provide lots of services that I use and I benefit from but equally what are they doing in the background and how concerned should we be um you know before we hit record we were talking about the fact that we use Instagram obviously a lot of the content that we produce through things like the the podcast is pushed out through platforms that are owned by big tech companies we use them we benefit from them but we worry about them at the same time Salesforce you don't you don't really have that same concern with no not at all that's why this is quite um this is like juicy information isn't it like what Oracle sales force breaching gdpr what how like because I think people think tech company how would they do that so that's why as soon as I heard it I was like what how are they doing it how have they got potentially got my details or your details I don't other than work we don't we would use them outside of work would you on a non- tech basis you wouldn't think you would anyway no no and I suppose that's the other point right 40 40% of those websites meaning that I have obviously come into contact with Oracle and sales I don't think I've ever used either of them personally but they must they must both have my data because 10 years ago they made the decision to buy this technology yeah mind you just never believe that would you but that's the thing like how many businesses out there have got our data then if we especially if it's being auctioned off without you knowing it and I suppose that's the whole point behind the lawsuit yeah I know and like she's so right as well like when it comes to cookies like if I go on a website If I decline the cookies some website you can't even go onto it so like I mean no one wants to do that we want to go on the website so why haven't we got the choice to just like not go not share your information isn't that mad well and as she says it's it's designed to make you kind of do that that rage click yeah uh you know fine I'll accept them all it's just too difficult it's designed to say sod it I just want to get as as you mentioned the cookie re not the cookie the brownie recipe you just want it so sod it yeah what's the worst that could happen I mean you've already got hanger so or hunger hangry you're hangry because of hunger so definitely accepting the cookies you know what I mean take my data take it so I can get that tray B yeah um yeah and like you said it's it's the ripple effect isn't it because bringing this lawsuit on behalf of of everyone in the UK 500 per person it's neither here or there really and how you'd give that 500s per person to everyone uh you know that it's it's not about that it's about the fact that this is setting a statement it's about the fact that this is the largest lawsuit of its kind it's testing gdpr 10 billion euros across the two suits this and the one in the Netherlands would send a clear message that this is not okay um and and if it's not okay hopefully then you would see some changes either in regulation or in the way that cookies are presented to people yeah no absolutely just it is mind-blowing like when I think about it like I on a dayto day I click accept cookies maybe I mean I go on Safari quite a lot maybe 10 times these data companies so I don't understand this so is it the data companies that are taking my data or is it the website and then they're selling it to data companies and then they're selling it to advertisement so as I understand it the technology has being bought by Oracle and Salesforce which means they collect the data and then they can auction it off to anybody they they they want for the highest bidder and and I think this is a really interesting point as well not only is it is it frustrating from uh who has my data point of view but also we've I've spoken on the podcast recently uh over the lockdown about advertising and about you know I'll buy a pair of trainers I can't remember the exact episode but it talks about the the the spefic spefic fact that I bought a pair of trainers and then was was immediately bombarded with adverts for trainers and it's like I've just bought trainers well I don't need more trainers that's like dumb advertising what I would like is accessories to go with trainers maybe then I'd buy and and because of the way in which data is being auctioned off Rebecca makes that link that they then just shove that thing that you've been looking at in front of you again desperate for you to buy it and it's it's leading to bad advertising yeah lazy advertising she she that is so true and and you know just hoovering up data and shoving it to to the highest bid and then back in front of you for something that you've already clicked on it's just gonna people off to be perfectly honest yeah it's true like sometimes I think like you know is it it because I think originally when I started getting all those adverts I thought is it my phone listening to me can it hear me saying I want a Lis Von bag or but in a way yeah because you click on a cookie and then it's tracking what you're clicking on so it knows I mean it's it's listening in terms of your your click so yes no exactly but and then I think oh do you know what do I really mind do I care because I'm clicking accept cookies every five minutes but but here's here's the key as as two people who are maybe relatively naive I don't care if that website has my data I'm not too is the default position do you care if actually that website doesn't have your data it's Oracle or Salesforce or someone else and they are selling it for their own financial gain to whoever else is willing to pay the highest amount for it and therefore profiting of you being misinformed or ill-informed we are the product when that is the case isn't it yeah I mean we're not even the product we're just unwitting participants in a bit of a scam we don't even know it's happening the majority of people don't know no we don't literally most people honestly I swear by it I only knew what a cookie was maybe like years ago MH what I was actually doing I mean I think it was I used to think it was like better not come across silly here um well no I think I think for the majority of people like people in technology might be familiar but I think that the vast majority of the population like if I if I was speaking to my parents or my parents-in-law or friends and family I don't think they'd know what it is no definitely not they think it was a Maryland cookie well yeah yeah exactly um why Maryland anyway fixating on the wrong things today yeah um and look I think she makes another really interesting point here as well around regulation regulation used to sit in silos regulation you know uh 105 years ago you could separate out regulation because because things weren't integrated now and as it's has been accelerated through the pandemic technology has become ever more prevalent in our society um there has been an explosion of um Generation Um ex's and Baby Boomers on social online through lockdown for obvious reasons um and therefore we need to beef up and integrate existing Regulators so that they can keep up with acceleration and this trend of people moving online you know shopping people people in their 50s and 60s doing their local local grocery shop instead of going to Tesco saintsbury waitr whatever using a cardo and so on uh and they are probably now clicking on cookies and they're more familiar with going online and they will not be familiar so there needs to be beefed up powers and it needs to be more integr ated and thought through because to be perfectly Frank one person on their own isn't going to be able to make a change no definitely and I think it's the more people that are aware that this is happening I think the more people will get involved won't they but isn't it just mad though this is going to be going on going on for three years that is a lot of time and effort um that Rebecca's putting into it and hold my hands up to her well done hope I wish her all the best absolutely I think on that note we will probably wrap up today we're not going to have news because this is obviously newsworthy in itself it's a bit of a departure from our normal let's focus on a company and talk about their evolution it's a piece of very topical stuff going on right now in in Tech um Haley thanks for your time um you're welcome if you do book some if you do sorry bake some cookies or some some brownies please feel free to share the the types of cookies that we like uh and other than that everyone have a lovely weekend see you I don't care I'm not coming back but W you you get out my head I'm trying to let you go but you're still under my skin when you talk it's just nice filling up my time but I ain't never going to me that I miss you cuz I won't give you the satisfaction oh