CJEU - C-61/19 - Orange Romania

Summary

The Court of Justice of the European Union (CJEU) in case C-61/19 ruled on Orange România's appeal against a Romanian data protection authority penalty for storing customer ID copies without valid consent. The court clarified that 'freely given' and 'informed' consent under GDPR requires active, not passive behavior; pre-ticked checkboxes and requiring handwritten refusal on standardized contracts do not meet consent requirements. The decision establishes that controllers must bear the burden of proving valid consent and that consent cannot be conditional on contract conclusion.

Full text

Help CJEU - C-61/19 - Orange Romania: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editNewer edit →VisualWikitext Revision as of 11:59, 17 October 2024 view sourceManTechnologist (talk | contribs)858 edits Tag: Visual edit← Older edit Revision as of 12:17, 9 July 2026 view source Ds (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators148 editsm Tag: Visual editNewer edit → Line 48: Line 48: ===Facts======Facts=== Orange România SA is a provider of mobile telecommunications services on the Romanian market. On 28 March 2018, the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (national Romanian data protection authority; ‘the ANSPDCP’), based on Article 32 of Law No 677/2001 (Romanian Data Protection Act) imposed an administrative penalty on Orange România (a provider of mobile telecommunication services on the Romanian market) on the ground that copies of the identity documents of its customers had been obtained and stored without their express consent. The DPA also ordered the controller to destroy already existing copies of the IDs.Orange România SA is a provider of mobile telecommunications services on the Romanian market. On 28 March 2018, the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (national Romanian data protection authority; ‘the ANSPDCP’), based on Article 32 of Law No 677/2001 (Romanian Data Protection Act) imposed an administrative penalty on Orange România (a provider of mobile telecommunication services on the Romanian market) on the ground that copies of the identity documents of its customers had been obtained and stored without their express consent. The DPA also ordered the controller to destroy already existing copies of the IDs. Orange România had requested consent for this data processing from its customers by giving them the opportunity to refuse their consent in handwritten form. Some of the contracts for mobile telecommunication services had a pre-ticked box signaling the consent to the storage of ID copies, while other did not. In order to signal that they do not give their consent to the storage of the ID copies, the customers had to fill out an additional form before the conclusion of the contract.Orange România had requested consent for this data processing from its customers by giving them the opportunity to refuse their consent in handwritten form. Some of the contracts for mobile telecommunication services had a pre-ticked box signaling the consent to the storage of ID copies, while other did not. In order to signal that they do not give their consent to the storage of the ID copies, the customers had to fill out an additional form before the conclusion of the contract. Line 54: Line 54: Orange România appealed against the ANSPDCP's decision before the Tribunalul Bucureşti (Regional Court, Bucharest, Romania) which then requested the CJEU'S preliminar ruling on the following questions:Orange România appealed against the ANSPDCP's decision before the Tribunalul Bucureşti (Regional Court, Bucharest, Romania) which then requested the CJEU'S preliminar ruling on the following questions: ‘''(1) For the purposes of Article 2(h) of Directive 95/46, what conditions must be fulfilled in order for an indication of wishes to be regarded as specific and informed?''"‘''(1) For the purposes of Article 2(h) Directive 95/46/EC, what conditions must be fulfilled in order for an indication of wishes to be regarded as specific and informed?''" "''(2) For the purposes of Article 2(h) of Directive 95/46, what conditions must be fulfilled in order for an indication of wishes to be regarded as freely given?''’"''(2) For the purposes of Article 2(h) Directive 95/46/EC, what conditions must be fulfilled in order for an indication of wishes to be regarded as freely given?''’ ===The opinion of the Advocate General======The opinion of the Advocate General=== Line 63: Line 63: Assessing the meaning of "freely given" and "informed" consent, he argued that "freely given consent" necessitates active, rather than passive behaviour. The data subject needs to enjoy a high degree of autonomy when choosing whether or not to give consent. Consent in the form of a preselected tick of a checkbox cannot imply active consent on the part of the data subject dealing with a physical document which he or she ultimately signs. "Informed consent" means, that there must not be any room whatsoever for any doubt that the data subject was not sufficiently informed.Assessing the meaning of "freely given" and "informed" consent, he argued that "freely given consent" necessitates active, rather than passive behaviour. The data subject needs to enjoy a high degree of autonomy when choosing whether or not to give consent. Consent in the form of a preselected tick of a checkbox cannot imply active consent on the part of the data subject dealing with a physical document which he or she ultimately signs. "Informed consent" means, that there must not be any room whatsoever for any doubt that the data subject was not sufficiently informed. On the burden of proof whether or not the data subject has given valid consent, the Advocate General reached the conclusion that it is for the controller to demonstrate that the data subject has consented to processing of his or her data (Art 7 (1) GDPR). This is equally true under Article 7(a) of the Directive 95/46, which required that the data subject has unambiguously given his or her consent.On the burden of proof whether or not the data subject has given valid consent, the Advocate General reached the conclusion that it is for the controller to demonstrate that the data subject has consented to processing of his or her data (Article 7(1) GDPR). This is equally true under Article 7(a) Directive 95/46/EC, which required that the data subject has unambiguously given his or her consent. On the consent form used by Orange România in its customer contracts, the Advocate General stated that the requirements of "freely given" consent has not been met: Obliging a customer to state in handwritten form that he or she does not consent to a processing (here i.e. copying and storing of his or her ID card) does not permit freely given consent. The customer is put into a situation in which he or she perceptibly deviates from a regular procedure which leads to the conclusion of a contract. Also there has been no "informed consent" as it is not made clear to the customer that a refusal to the processing at hand does not make the conclusion of a contract impossible.On the consent form used by Orange România in its customer contracts, the Advocate General stated that the requirements of "freely given" consent has not been met: Obliging a customer to state in handwritten form that he or she does not consent to a processing (here i.e. copying and storing of his or her ID card) does not permit freely given consent. The customer is put into a situation in which he or she perceptibly deviates from a regular procedure which leads to the conclusion of a contract. Also there has been no "informed consent" as it is not made clear to the customer that a refusal to the processing at hand does not make the conclusion of a contract impossible. Line 69: Line 69: In conclusion the Advocate General proposed that the CJEU answer the questions referred by the Tribunalul Bucureşti as follows:In conclusion the Advocate General proposed that the CJEU answer the questions referred by the Tribunalul Bucureşti as follows: "''A data subject intending to enter into a contractual relationship for the provision of telecommunication services with an undertaking does not give his or her ‘consent’, that is, does not indicate his or her ‘specific and informed’ and ‘freely given’ wishes, within the meaning of Article 2(h) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with rega

Entities