The European Court of Justice’s legal interpretation, following a dispute between the mobile telecommunications services provider Orange România SA and the Romanian National Data Protection Authority (“Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal”), shed light on an interesting aspect of the consent of those concerned. The ECJ’s judgment of 11 November 2020 served to reiterate the interpretation of the rules on contractual clauses and free and informed consent of data subjects in the light of the GDPR.
On 28 March 2018, the ANSPDCP imposed a fine on Orange România for collecting and storing copies of its customers’ identity documents without their express consent and ordered them to destroy those copies. The reason was that, during the period from 1 to 26 March 2018, the provider had concluded contracts for the provision of mobile telecommunications services which contain a clause stating that customers have been informed of and have consented to the collection and storage of a copy of their identity documents for identification purposes. The box relating to that clause had been ticked by the data controller before the contract was signed.
The reference for a preliminary ruling
After receiving an appeal from Orange România, the High Court of Bucharest (“Tribunalul București”) suspended the proceedings and referred the case to the ECJ for a preliminary ruling on the conditions in which the customers’ consent to the processing of personal data may be considered valid. First of all, the ECJ clarified that, according to the “GDPR” Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, the data subject’s consent must be freely given, specific, informed and unambiguous. For that reason, consent is not validly given in the case of silence, pre-ticked boxes or inactivity. Moreover, in order to ensure that the data subject enjoys genuine freedom of choice and the customers are aware of the consequences of any consent given, the terms of the consent declaration form must be written in a clear and plain language and must not mislead customers as to the possibility of concluding the contract even if they refuse to consent to the processing of their data. In the light of the above, the ECJ noted that, since Orange România is the controller of personal data, it must be able to demonstrate the lawfulness of the processing of those data with regard to the existence of the valid consent of its customers.
The ECJ’s legal interpretation
According to the ECJ, given that the customers concerned do not appear to have themselves ticked the box relating to the collection and storage of copies of their identity documents, the mere fact that the box was pre-ticked from the provider is not suitable to demonstrate a positive expression of their consent in the present case. In addition, the free nature of such consent is called into question by the fact that, in the event of customers’ refusal to consent to the processing of their data, Orange România required them to declare in writing that they did not consent to a copy of their identity document being collected or stored. As stated by the ECJ, since Orange România was required to establish that its customers have, by active behaviour, given their consent to the processing of their personal data, it cannot require them actively to express their refusal and this additional requirement unreasonably restricts the free choice to object to the collection and storage of such personal data.
The ECJ therefore concluded that “a contract for the provision of telecommunications services containing a clause stating that the customer has consented to the collection and storage of his or her identity document cannot demonstrate that the customer has validly given his or her consent where the box referring to that clause has been ticked by the data controller before the contract was signed”. As stated by the ECJ, that is also the case where customers are misled as to the possibility of concluding the contract if they refuse to consent to the processing of their data, or where the freedom to choose to object to that collection and storage is affected by the requirement to complete an additional form setting out that refusal.
Lorenzo D’Ilario (ELSA trainee lawyer)