CJEU - C-61/19 - Orange Romania
| CJEU - C-61/19 | |
|---|---|
 | |
| Court: | CJEU |
| Jurisdiction: | European Union |
| Relevant Law: | Article 4(11) GDPR Article 6(1)(a)GDPR Article 7 GDPR Article 2(2)(h) Directive 95/46 Article 6 Directive 95/46 Article 7 Directive 95/46 Article 32 Law No 677/2001 on the protection of persons with regard to the processing of personal data and on the free movement of such data (Romanian Data Protection Act) |
| Decided: | OPINION OF ADVOCATE GENERAL: 04.3.2020 |
| Parties: | Orange România SA Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) |
| Case Number/Name: | C-61/19 |
| European Case Law Identifier: | ECLI:EU:C:2019:801 |
| Reference from: | |
| Language: | 24 EU Languages |
| Original Source: | AG Opinion |
| Initial Contributor: | n/a |
The Advocate General Maciej Szpunar gave his opinion on the concept of consent of the data subject and the burden of proof regarding a declaration of consent by means of a tick box used by a Romanian telecomunication provider: Consent demands the indication of specific and informed wishes of the data subject.
Facts
On 28 March 2018, the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (national Romanian data protection authority; ‘the ANSPDCP’), based on Article 32 of Law No 677/2001 (Romanian Data Protection Act) imposed an administrative penalty on Orange România (a provider of mobile telecommunication services on the Romanian market) on the ground that copies of the identity documents of its customers had been obtained and stored without their express consent.
Orange România had requested consent for this data processing from its customers by giving them the opportunity to refuse their consent in handwritten form on the physical contract forms used by Orange România.
Orange România appealed against the ANSPDCP's decision before the Tribunalul Bucureşti (Regional Court, Bucharest, Romania) which then requested the CJEU'S preliminar ruling on the following questions:
‘(1) For the purposes of Article 2(h) of Directive 95/46, what conditions must be fulfilled in order for an indication of wishes to be regarded as specific and informed?"
"(2) For the purposes of Article 2(h) of Directive 95/46, what conditions must be fulfilled in order for an indication of wishes to be regarded as freely given?’
The opinion of the Advocate General
The Advocate General(Maciej Szpunar) assessed the case both under the Directive 95/46 and under the GDPR and came to the same opinion under both legal frameworks:
Assessing the meaning of "freely given" and "informed" consent, he argued that "freely given consent" necessitates active, rather than passive behaviour. The data subject needs to enjoy a high degree of autonomy when choosing whether or not to give consent. Consent in the form of a preselected tick of a checkbox cannot imply active consent on the part of the data subject dealing with a physical document which he or she ultimately signs. "Informed consent" means, that there must not be any room whatsoever for any doubt that the data subject was not sufficiently informed.
On the burden of proof whether or not the data subject has given valid consent, the Advocate General reached the conclusion that it is for the controller to demonstrate that the data subject has consented to processing of his or her data (Art 7 (1) GDPR). This is equally true under Article 7(a) of the Directive 95/46, which required that the data subject has unambiguously given his or her consent.
On the consent form used by Orange România in its customer contracts, the Advocate General stated that the requirements of "freely given" consent has not been met: Obliging a customer to state in handwritten form that he or she does not consent to a processing (here i.e. copying and storing of his or her ID card) does not permit freely given consent. The customer is put into a situation in which he or she perceptibly deviates from a regular procedure which leads to the conclusion of a contract. Also there has been no "informed consent" as it is not made clear to the customer that a refusal to the processing at hand does not make the conclusion of a contract impossible.
In conclusion the Advocate General proposed that the CJEU answer the questions referred by the Tribunalul Bucureşti as follows:
"A data subject intending to enter into a contractual relationship for the provision of telecommunication services with an undertaking does not give his or her ‘consent’, that is, does not indicate his or her ‘specific and informed’ and ‘freely given’ wishes, within the meaning of Article 2(h) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and of Article 4(11) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), to that undertaking when he or she is required to state, in handwriting, on an otherwise standardised contract, that he or she refuses to consent to the photocopying and storage of his or her ID documents."
The decision of the Court
To be completed once the CJEU has given its ruling.
Comment
Add your comment here!
