The Court of Justice of the European Union has issued its ruling in the Case C-61/19 Orange România SA v Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal.
It ruled that a contract for mobile telecommunications services stating that the customer has consented to the collection and storage of their identity document does not mean that that customer has validly given consent where the box referring to that clause has been pre-ticked by the data controller.
This also applies where the customer is misled about whether they can conclude the contract if they refuse to consent to the processing of their data, or where the freedom to choose to object to that collection and storage is affected by the requirement to complete an additional form setting out that refusal.
Orange România SA provides mobile telecommunications services. In March 2018, the Romanian data protection authority imposed a fine on Orange for collecting and storing copies of its customers’ identity documents without their express consent. It said that in March 2018, Orange had issued contracts stating that customers had been informed of, and had consented to, the collection and storage of a copy of their identity documents for identification purposes. The box relating to the relevant contractual clause had been ticked by the data controller before the contract was signed.
The Romanian Court referred the case to the CJEU asking it to set out the conditions in which the customers’ consent to the processing of personal data may be considered valid. The Advocate General issued an opinion earlier this year.
The Court noted that EU law provides for the circumstances in which the processing of personal data can be regarded as being lawful. In particular, the data subject’s consent must be freely given, specific, informed and unambiguous. Consent is not validly given in the case of silence, pre-ticked boxes or inactivity.
In addition, if the data subject’s consent is given in the context of a written declaration which also concerns other matters, that declaration must be presented in an intelligible and easily accessible form, using clear and plain language. To ensure that the data subject enjoys genuine freedom of choice, the contractual terms must not mislead them about whether they can enter into the contract even if they refuse to consent to the processing of their personal information.
The Court said that because Orange România is the data controller, it must be able to demonstrate the lawfulness of the processing of that data and therefore, in this case, the existence of the valid consent of its customers. As the customers concerned did not appear to have themselves ticked the box relating to the collection and storage of copies of their identity documents, the mere fact that the box was ticked did not establish a positive indication of their consent. It is for the national court to carry out the relevant investigations.
According to the Court, it is also the national court’s role to assess if the contractual terms at issue were capable of misleading the customers concerned about the opportunity to enter into the contract despite a refusal to consent to the data processing.
In addition, if a customer refuses to consent to the processing of their personal information, the Court said that Orange România required them to declare in writing that they did not consent to a copy of their identity document being collected or stored. According to the Court, such an additional requirement is liable to unduly affect the freedom to choose to object to that collection and storage.
In any event, Orange should have established that its customers had actively given their consent to the data processing, and could not require them to actively express their refusal.
