Global Data Breaches in Google's Outsourcing Chain Trigger Class Actions in EU and US

Appeal Court Also Rejects Teleperformance Gag Order

Lisbon / Paris - Cambridge Samuel today announces the launch of collective actions in the European Union and the United States against the key players in Google's outsourcing chain - Teleperformance, Cognizant, and Concentrix - over massive, global data breaches affecting YouTube and Waze end‐users. The actions will be expanded to more than 30 jurisdictions worldwide over the coming years.

The case originates from a protected whistleblower who received thousands of emails containing sensitive personal data of end‐users, leaked for more than 480 days via internal Google systems (Buganizer, Cases, Google Sheets). Affected individuals are located in the US, UK, Canada, Brazil, Israel, South Korea, Vietnam, Indonesia, India, Thailand, and many EU member states.

Class actions - coordination with Ius Omnibus in Portugal and EDPB

In Portugal, a class action against Google is already pending before the Lisbon Court, filed by Ius Omnibus. Cambridge Samuel is exploring the possibility of joining or coordinating with that existing proceeding to ensure efficient redress for Portuguese victims. In parallel, separate collective actions will be filed in the United States (federal court), United Kingdom, Germany, France, Canada, Brazil, and Israel, with the remaining jurisdictions to follow. For EU-based actions, the competent supervisory authorities and the European Data Protection Board (EDPB) will be requested to ensure consistent cross-border enforcement under the GDPR's cooperation and consistency mechanisms.

Discussions with specialised law firms and litigation funders have started in all these countries to ensure coordinated, well‐financed litigation.

Appeal Court rejects Teleperformance gag order

Recently, the Lisbon Court of Appeal confirmed the lower court's decision and rejected Teleperformance's attempt to impose a publication ban on the whistleblower. The court held that Teleperformance failed to demonstrate any concrete, serious, or irreparable harm. While this judgment is an important confirmation of the whistleblower's right to speak, the main focus now shifts to holding the entire outsourcing chain accountable for the data breaches.

Strong whistleblower protection under EU Directive 2019/1937:

Article 7 - The whistleblower was locked out of his Google Workspace account by a google.com administrator before he could even inform his employer. This real, materialised risk of retaliation, combined with the pressing public interest of data breaches affecting millions of end users, entitled him to go public directly - without first exhausting internal channels. His internal emails were an extra act of good faith, not a legal prerequisite.

Article 21 - The subsequent disciplinary suspension and dismissal constitutes prohibited retaliation. Paragraph 6 renders such a sanction void from the outset. Paragraph 4 places the burden on the employer to prove the suspension and dismissal was unrelated to the protected disclosure - a burden Teleperformance cannot meet.

Articles 22, 23, 24 - Guarantee legal aid, an effective judicial remedy, and full immunity from civil, criminal, or disciplinary liability for good‐faith whistleblowing.

public-relations@cambridgesamuel.com
+351 214 00 55 00 (by appointment only)

Pç do Marquês de Pombal 14, 1250-162 Lisboa
Sofia Goncalves

Cambridge Samuel is an independent advocacy platform and not a law firm. Individuals are encouraged to seek qualified legal counsel. All disclosures are made in the public interest and in protection of fundamental rights under EU and Portuguese law.

This release was published on openPR.