CJEU - C‑654/23 - Inteligo Media SA
| CJEU - C‑654/23 Inteligo Media SA | |
|---|---|
 | |
| Court: | CJEU |
| Jurisdiction: | European Union |
| Relevant Law: | Article 83(2) GDPR Article 95 GDPR Article 13 Directive 2002/58/EC |
| Decided: | |
| Parties: | Inteligo Media SA Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) |
| Case Number/Name: | C‑654/23 Inteligo Media SA |
| European Case Law Identifier: | ECLI:EU:C:2025:213 |
| Reference from: | Court of Appeal Bucharest (Romania) |
| Language: | 24 EU Languages |
| Original Source: | AG Opinion |
| Initial Contributor: | tjk |
The AG opined, that the transmission of a daily newsletter constitutes ‘direct marketing’ for ‘similar products or services’, within the meaning of Article 13(2) of Directive 2002/58/EC. Furthermore, when the processing of personal data has been found lawful on the basis of that provision, Article 6 GDPR is not applicable.
English Summary
Facts
Inteligo Media SA (the controller) is the publisher of the online news publication, which informs the general public about the legislative changes occurring each day in Romania. By subscribing to a 'Premium Service', users can access more articles per month and receive a daily newsletter, via email, called ‘Personal Update’ (unless the user opts not to benefit from that service).
On 26 September 2019, the Romanian DPA (‘the DPA’) concluded that the controller had infringed Article 5(1)(a) and (b), Article 6(1)(a) and Article 7 GDPR and imposed an administrative fine of ca €9,000 (RON 42,714). The DPA had found that the controller had processed the personal data (email addresses, passwords, usernames) of 4,357 users on a legal basis which was not appropriate for the daily transmission via email of the Personal Update, without proving that it had obtained the express consent of the users to the processing of their personal data for that purpose.
The controller initiated legal proceeding requesting, principally, the annulment of the DPA's decision and its exemption from liability for the administrative offense. Both the controller and the DPA appealed against a first instance judgement. Those appeals are pending before the referring court.
In those circumstances, the referring court decided to stay the proceedings and to refer the following questions to the Court of Justice for a preliminary ruling:
- In a case in which a publisher of online news publications [...] obtains the email address of a user when the latter creates a free user account entitling him or her: (i) to access, free of charge, an additional number of articles from the publication in question; (ii) to receive, via email, a daily newsletter containing a summary of the new legislation discussed in articles within the publication and hyperlinks to those articles; and (iii) to access, for a fee, additional and/or more extensive articles and analyses from the publication compared with those in the free daily newsletter:
- (a) is that email address obtained by the publisher of the online news publication “in the context of the sale of a product or a service” within the meaning of Article 13(2) of [Directive 2002/58]?
- (b) is the transmission by the news publisher of a newsletter such as that described in the abovementioned point (ii) carried out “for direct marketing of its own similar products or services” within the meaning of Article 13(2) of [Directive 2002/58]?
- If the answers to Question 1(a) and (b) is "yes", which of the conditions laid down in Article 6(1)(a) to (f) of [the GDPR] apply when the publisher uses the user’s email address for the purpose of sending a daily newsletter [...], in accordance with the requirements of Article 13(2) of [Directive 2002/58]?
- Does Article 13(1) and (2) of [Directive 2002/58] preclude national legislation which uses the concept of “commercial communication” laid down in Article 2(f) of [Directive 2000/31/EC (5)] instead of the concept of “direct marketing” laid down in [Directive 2002/58]? If not, does a newsletter [...] constitute a “commercial communication” within the meaning of Article 2(f) of [Directive 2000/31]?
- If the answers to Question 1(a) and (b) are in the negative:
- (a) does the transmission via email of a daily newsletter[...] constitute “use … of electronic mail for the purposes of direct marketing” within the meaning of Article 13(1) of [Directive 2002/58]?
- (b) must Article 95 GDPR, in conjunction with Article 15(2) of [Directive 2002/58], be interpreted as meaning that failure to comply with the conditions for obtaining valid consent from the user pursuant to Article 13(1) of [Directive 2002/58] will be penalised in accordance with Article 83 GDPR or in accordance with the provisions of national law contained in the act transposing [Directive 2002/58], which contains specific penalties?
- Must Article 83(2) GDPR be interpreted as meaning that a DPA which decides whether to impose an administrative fine and decides on the amount of the administrative fine in each individual case is obliged to analyse and explain in the administrative act imposing the fine the effect of each of the criteria laid down in points (a) to (k) on the decision to impose a fine and, respectively, on the decision regarding the amount of the fine imposed?
Advocate General Opinion
1st and 4th Question: Sending a newsletter after the creation of online account constitutes direct marketing
The AG summarized that the referring court seeks to ascertain, in essence, whether it can be considered that a user’s email address obtained when he or she creates an online account entitling them to free access to a number of articles/resources and to receive, by email, a daily newsletter, is obtained ‘in connection with the sale of a product or a service’ and whether the transmission of the daily newsletter constitutes ‘direct marketing’ for ‘similar products or services’, within the meaning of Article 13(2) of Directive 2002/58.
The AG considered CJEU, C-484/14, McFadden, opining that the Personal update pursued an advertising purpose which in turn constitutes an indirect form of remuneration which satisfies the CJEU’s definition of a ‘sale’.
Thus, the AG opined that Article 13(2) of Directive 2002/58 must be interpreted as meaning that a user’s email address obtained when he or she creates an online account entitling him or her to a 'Personal Update' such as the one in question constitutes ‘direct marketing’ for ‘similar products or services’, within the meaning of that provision.
Given the proposed reply to the first question and the first part of the fourth question, there is no need to reply to the second part of the fourth question.
2nd Question: Is Article 6(1) GDPR applicable when sending newsletters in accordance with Article 13(2) of Directive 2002/58
The AG opined, that Article 95 GDPR establishes the principle lex specialis derogat legi generali for the relationship between that directive and the GDPR: whenever there is a specific provision in Directive 2002/58 entailing obligations with the same objective as corresponding provisions in the GDPR, it is the provision of Directive 2002/58 which must be applied.
The AG held, that Article 13(2) of Directive 2002/58 comprehensively governs the conditions and purposes of the processing as well as the rights of the data subject and imposes ‘specific obligations’ on the controller, within the meaning of Article 95 GDPR including specifically the question of consent. As a consequence, the AG found, that recourse to the GDPR, in particular Article 6(1)(a) to (f) GDPR, is neither possible nor necessary.
3rd Question: Does Article 13(1) and (2) of Directive 2002/58 preclude national legislation which, in transposing that directive, replaces the term ‘direct marketing’ with the term ‘commercial communication’, as defined in Article (2)(f) of Directive 2000/31
The AG opined that, commercial communication has a wider scope that encompasses the concept of direct marketing; thus all direct marketing constitutes commercial communication, but not all commercial communication constitutes direct marketing, However, the AG considered this question to be hypothetical with respect to the case at issue and, therefore inadmissible.
5th Question: Necessary to explain all criteria in Article 83(2) GDPR when imposing fines?
The AG summarised the question as to whether, when a DPA imposes an administrative fine, it is required to analyse and explain in the administrative act concerned the impact of each of the criteria provided for in Article 83(2)(a) to (k) GDPR. Since that question refers to the eventuality that the GDPR is applicable to the present case, the AG responded only for the case that the CJEU should find that the GDPR is applicable contrary to his Opinion above.
On this the AG concluded, that as long as an individual can understand the grounds of the individual measure adversely affecting them, the obligation springing from the principle of respect for the rights of the defence) of the administration to state reasons for a decision which are sufficiently specific and concrete is complied with, without it being necessary to go into detail regarding each of the criteria listed in Article 83(2) GDPR.
Holding
-
Comment
Additionally the AG held, that in the modern digital age, data themselves are treated as a commodity. Thus, it could be envisaged that for data to have been collected ‘in the context of a sale’, it is sufficient that a user furnishes their personal data in exchange for a good or service of value to them.
Further Resources
Share blogs or news articles here!
