BGH - I ZR 7/16

BGH - I ZR 7/16
Court:	BGH (Germany)
Jurisdiction:	Germany
Relevant Law:	Article 4(11) GDPR Article 94 GDPR
Decided:	28.05.2020
Published:	28.05.2020
Parties:	Bundesverband der Verbraucherzentralen v. anonymous
National Case Number:	VI ZB 39/18
European Case Law Identifier:	ECLI:DE:BGH:2019:240919BVIZB39.18.0
Appeal from:	OLG Frankfurt (Higher Regional Court)
Language:	German
Original Source:	Juris BGH (in DE)

The German Federal Court of Justice has decided on the question of which requirements must be met for consent to telephone advertising and the storage of cookies on the user's terminal device.

Comment

Share your comment here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the original. Please refer to the German original for more details.

DECISION
Judgment of 28 May 2020 - I ZR 7/16 - Cookie Consent II 
The I. Civil Senate of the Federal Court of Justice, which is responsible for claims under the Injunctions Act (Unterlassungsklagengesetz), among other things, has decided on the question of which requirements must be met for consent to telephone advertising and the storage of cookies on the user's terminal device. 
Facts: 
The plaintiff is the Federal Association of Consumer Organisations. The defendant organized a lottery in September 2013 at its Internet address. After entering the postcode, the user was taken to a page on which the user's name and address had to be entered. Two consent forms with checkboxes were located under the address entry fields. 
By confirming the first text, the checkbox of which was not marked with a preset tick, the consent to an advertisement by sponsors and cooperation partners of the defendant by mail, telephone, e-mail or SMS should be declared. It was possible to select the advertising sponsors and cooperation partners from a linked list of 57 companies. Otherwise, the Defendant should make this selection. 
The second checkbox had a default check mark and had the following text: 
"I agree to use the web analysis service Remintrex in my company. As a result, the lottery organiser, the [defendant], will set cookies after registration for the lottery, which [the defendant] can use to evaluate my surfing and usage behaviour on the websites of advertising partners and thus enable Remintrex to advertise in a way that is directed at my interests. I can delete the cookies at any time. Read more here." 
In the explanation linked to the word "here", it was pointed out that the cookies would receive a specific, randomly generated number (ID) associated with the registration data of the user who entered his name and address in the web form provided. If the User with the stored ID would visit the website of an advertising partner registered for Remintrex, this visit should be recorded as well as the product in which the User is interested and whether a contract is concluded. 
The preset hook could be removed. However, participation in the competition was only possible if at least one of the two fields was marked with a tick. 
To the extent relevant in the appeal proceedings, the plaintiff has requested that the defendant be prohibited from including or invoking corresponding declarations of consent in lottery agreements with consumers. The plaintiff has also demanded reimbursement of the costs of the warning. 
Previous course of the process: 
The Regional Court ordered the defendant to cease and desist with regard to both declarations of consent and to pay warning costs. The appeal of the defendant was successful with regard to the application for a cease and desist order on the use of the declaration of consent to the use of cookies, which is provided with a preset checkbox. Both parties have lodged the appeal permitted by the Higher Regional Court. 
The German Federal Supreme Court (Bundesgerichtshof) suspended the proceedings by order of 5 October 2017 and referred various questions to the Court of Justice of the European Union on the interpretation of Directive 2002/58/EC (Directive on privacy and electronic communications), Directive 95/46/EC (Data Protection Directive) and Regulation (EU) 2016/679 (Basic Data Protection Regulation) with regard to the effectiveness of consent to the placing of cookies by a pre-selected checkbox. These questions were answered by the Court of Justice of the European Union in its judgment of 1 October 2019. 
Decision of the Federal Court of Justice: 
The Federal Court of Justice has now rejected the defendants' appeal and, on the plaintiff's appeal, overturned the judgment on appeal regarding the cookie consent and restored the first instance conviction of the defendants. 
With regard to consent to telephone advertising, the defendant is obliged under Paragraphs 1 and 3(1)(1) of the UKlaG in conjunction with Paragraph 307(1), first sentence, and (2)(1) of the BGB and Paragraph 7(2)(2)(1) of the UWG to refrain from and reimburse the costs of warning, because there is a lack of effective consent to telephone advertising both under the legal situation applicable at the time of the act complained of and under the legal situation at the time of the decision. § Paragraph 7(2)(2) of the UWG serves to transpose Article 13(3) and the first sentence of Article 13(5) of Directive 2002/58/EC, Article 2(2)(f) of which refers to Article 2(h) of Directive 95/46/EC for the definition of consent, so that the concept of 'consent' must be determined in conformity with the directive. For the period from 25 May 2018, the definition provided for in Article 4(11) of Regulation (EU) 2016/679 is to be applied, since since then, pursuant to Article 94(1) and (2), first sentence, of that regulation, references to the repealed Directive 95/46/EC shall be construed as references to this regulation. 
Consent is given 'with full knowledge of the facts' within the meaning of Article 2(h) of Directive 95/46/EC if the consumer knows that his statement constitutes consent and what it relates to. Consent is given "on a case-by-case basis" within the meaning of this provision if it is clear which products or services of which companies it specifically covers. This is lacking in the case of a dispute, because the contested form of the declaration of consent is designed to confront the consumer with an elaborate procedure of selecting partner companies on the list in order to induce him to refrain from this selection and instead leave the choice of advertising partners to the defendant. If the consumer does not know the products or services of which entrepreneurs the consent is covered due to lack of knowledge of the contents of the list and without exercising the right to choose, no consent is given for the specific case. For these reasons, consent "for the specific case" within the meaning of Art. 4 No. 11 of Regulation (EU) 2016/679 is also lacking, which has not brought about any change in the law in this respect. 
With regard to the consent to the storage of cookies, the plaintiff is also entitled to a claim for injunction in accordance with § 1 UKlaG in connection with § 307 para. 1 sentence 1 and para. 2 no. 1 BGB. The consent of the user provided by the defendant in the form of a General Terms and Conditions of Business, which allows the retrieval of information stored on his terminal device by means of cookies by means of a preset checkbox, constitutes an unreasonable disadvantage for the user both under the law applicable at the time of the action complained of and under the law applicable at the time of the decision. 
According to the legal situation as it stood until 24 May 2018 - i.e. before the validity of Regulation (EU) 2016/679 - obtaining consent by means of a pre-selected checkbox was incompatible within the meaning of Section 307 (2) no. 1 of the German Civil Code (Bürgerliches Gesetzbuch - BGB) with essential basic ideas of Section 15 (3) sentence 1 of the German Telemedia Act (Telemediengesetz - TMG). The objectionable use of cookies by the defendant as a service provider serves, as presupposed by Section 15 (3) sentence 1 German Telemedia Act, the creation of user profiles for the purpose of advertising, in that the behaviour of the user on the Internet is to be recorded and used to send advertising tailored to it. In the event of a dispute, the random number (ID) stored in the cookies, which is assigned to the user's registration data, is a pseudonym within the meaning of this provision. § With regard to Art. 5 (3) sentence 1 of Directive 2002/58/EC in the version amended by Art. 2 No. 5 of Directive 2009/136/EC, Section 15 (3) sentence 1 of the German Telemedia Act must be interpreted in conformity with the Directive to the effect that the use of cookies to create user profiles for the purposes of advertising or market research requires the consent of the user. The Court of Justice of the European Union, acting on a reference from the Senate, ruled that Article 2(f) and the first sentence of Article 5(3) of Directive 2002/58/EC, in conjunction with Article 2(h) of Directive 95/46/EC, must be interpreted as meaning that there is no effective consent within the meaning of those provisions where the storage of information or access to information already stored in the user's terminal equipment of a website by means of cookies is permitted by means of a pre-selected checkbox which the user must unselect in order to refuse consent. According to the Court's decision, the question whether the information is personal data is not relevant in this context. The interpretation of Section 15 (3) sentence 1 of the German Telemedia Act in conformity with the Directive does not preclude the fact that the German legislature has not yet adopted an act of transposition. This is because it can be assumed that the legislature considered the existing legal situation in Germany to be in conformity with the Directive. A corresponding interpretation in conformity with the Directive is still compatible with the wording of Section 15 (3) sentence 1 German Telemedia Act. In the absence of (effective) consent, in view of the fact that the legislature saw the Union law requirement for consent implemented in Section 15 (3) sentence 1 German Telemedia Act, the contradiction according to this provision which contradicts the permissibility of the creation of user profiles can be seen. 
This legal situation has not changed since 25 May 2018, the first day of application of Regulation (EU) 2016/679, because, according to Article 95 of that regulation, it does not affect the continued validity of Section 15(3) sentence 1 of the German Telemedia Act as a national provision transposing the first sentence of Article 5(3) of Directive 2002/58/EC. To the extent that Article 2(h) of the repealed Directive 95/46/EC can no longer be taken as a basis for the definition of consent, but Article 4 No. 11 of Regulation (EU) 2016/679 is to be applied, this leads to the same result. The Court of Justice of the European Union, upon referral by the Senate, has ruled, also with regard to Article 4 No. 11 of Regulation (EU) 2016/679, that a preset checkbox to be selected by the user does not constitute valid consent. 
Lower courts: 
LG Frankfurt am Main - Judgment of 10 December 2014 - 2/6 O 30/14 
OLG Frankfurt am Main - Judgment of 17 December 2015 - 6 U 30/15 
Federal Supreme Court, decision of 5 October 2017 - I ZR 7/16, Cookie Consent I 
ECJ, Judgment of 1 October 2019, C-673/17, PLANET49 
The relevant provisions are as follows: 
§ Section 1 UKlaG: 
Anyone who uses or recommends in General Terms and Conditions of Business provisions which are invalid according to §§ 307 to 309 of the German Civil Code (Bürgerliches Gesetzbuch), or recommends them for legal transactions, can be held liable for omission and, in the case of recommendation, also for revocation. 
§ Section 307 (1) sentence 1 and (2) no. 1 of the German Civil Code: 
(1) Provisions in general terms and conditions are invalid if they disadvantage the user's contractual partner contrary to the requirements of good faith. … 
(2) Unreasonable discrimination shall be presumed in cases of doubt where a provision 
1. is not compatible with essential basic ideas of the legal regulation from which it deviates 
§ Paragraph 7(1), first sentence, and (2), No 2, of the UWG: 
1. Any commercial act which causes an unreasonable nuisance to an operator shall be prohibited. … 
(2) Unacceptable harassment shall always be assumed 
2. in the case of advertising by telephone call to a consumer without the prior express consent of the consumer or to any other market participant without the at least presumed consent of the consumer. 
§ Section 15 (3) sentence 1 TMG: 
The service provider may create user profiles using pseudonyms for the purposes of advertising, market research or for the needs-based design of telemedia, provided the user does not object to this. 
Article 2, second sentence, point (f) of Directive 2002/58/EC: 
Furthermore, for the purposes of this Directive, 'consent' of a user or subscriber shall mean the consent of the data subject within the meaning of Directive 95/46/EC; 
Article 5(3), first sentence, of Directive 2002/58/EC: 
Member States shall ensure that the storage of information or access to information already stored in the terminal equipment of a subscriber or user is only allowed if the subscriber or user concerned has given his consent on the basis of clear and comprehensive information obtained in accordance with Directive 95/46/EC, inter alia, about the purposes of the processing. 
Article 2(h) of Directive 95/46/EC: 
For the purposes of this Directive, 'the data subject's consent' shall mean any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed. 
Article 4 No 11 of Regulation (EU) 2016/679: 
For the purposes of this Regulation, 'the data subject's consent' shall mean any freely given specific, informed and unequivocal expression of his or her wishes in the form of a declaration or other unequivocal affirmative act by which the data subject signifies his or her agreement to the processing of personal data relating to him or her. 
Article 94(1) and (2) first sentence of Regulation (EU) 2016/679: 
1. Directive 95/46/EC is hereby repealed with effect from 25 May 2018. 
2. References to the repealed Directive shall be construed as references to this Regulation. … 
Article 95 of Regulation (EU) 2016/679: 
This Regulation shall not impose additional obligations on natural or legal persons in respect of processing in connection with the provision of publicly available electronic communications services in public communications networks in the Union where they are subject to specific obligations laid down in Directive 2002/58/EC which pursue the same objective. 
Karlsruhe, 28 May 2020