European court rules that pre-ticked boxes do not constitute valid consent under data protection law

Orange România SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal, Case No. C-61/19

Court: Court of Justice of the European Union (CJEU)

Date of judgment: 11 November 2020

*****

Relevance of the case

In this case, the CJEU held that a contract for the provision of telecommunications services that contains a clause stating that the data subject has been informed of, and has consented to, the collection and storage of a copy of his or her identity document for identification purposes is not sufficient to demonstrate that the person has validly consented in the following circumstances:

• Where the box referring to that clause has been pre-ticked by the data controller before the contract was signed;
• Where the terms of that contract are capable of misleading the data subject as to the possibility of concluding the contract in question, even if he or she refuses to consent to the processing of his or her data; or
• Where the freedom to choose to object to that collection and storage is unduly affected by that controller, in that it requires that the data subject, in order to express his or her refusal to consent to such processing, must complete an additional form setting out that refusal.

Factual background

Orange România SA is a provider of mobile telecommunications services in Romania. In March 2018, the local data protection authority imposed a fine on the company for collecting and storing copies of its customers’ identity documents without their express consent. Specifically, during the course of March 2018, the company had concluded contracts that contained a clause stating that customers have been informed of, and have consented to, the collection and storage of a copy of their identity documents for identification purposes. The box relating to that clause had been ticked by the data controller before the contract was signed.

Following this, the Regional Court of Bucharest requested the CJEU to specify the conditions in which customers’ consent to the processing of personal data may be considered valid.

Ruling of the CJEU

As a point of departure, the CJEU noted that the relevant data protection laws of the European Union provide for a list of cases in which the processing of personal data may be regarded as lawful. This includes that the data subject’s consent must be freely given, specific, informed and unambiguous. The CJEU held that consent is not validly given in the case of silence, pre-ticked boxes or inactivity.

Furthermore, the CJEU held that if the data subject’s consent is given in the context of a written declaration which also concerns other matters, that declaration must be presented in an intelligible and easily accessible form, using clear and plain language. In order to enjoy the freedom of choice, the contractual terms must not mislead the data subject as to the possibility of concluding the contract, even if the data subject refuses to consent to the processing of such data.

In the present matter, the CJEU explained that Orange România SA – as the controller of personal data – must be able to demonstrate the lawfulness of the processing of that data, including the existence of the valid consent of its customers. As it was apparent that the customers did not themselves tick the boxes relating to the collection and storage of their identity documents, the mere fact that the box was ticked would not be sufficient to establish a positive indication of their consent.

The CJEU also directed the national court to assess whether the contractual terms at issue were capable of misleading the customers as to the possibility of concluding the contract, notwithstanding a refusal to consent to the processing of their data, in the absence of specific details on that possibility. In addition, where a customer refuses to consent, the CJEU pointed out that Orange România SA required the data subject to declare in writing that he or she did not consent. According to the CJEU, this additional requirement would be liable to unduly affect the freedom to choose to object to that collection and storage. Moreover, since Orange România SA was required to establish that its customers have, by active behaviour, given their consent to the processing of their personal data, it cannot require them to actively express their refusal.

The full judgment is accessible here.

The CJEU’s press release is accessible here.

Please note: The information contained in this note is for general guidance on matters of interest, and does not constitute legal advice. For any enquiries, please contact us at [email protected].