12/11/2020

Technology & eCommerce Regulation in the Spotlight

On 11 November 2020, the European Court of Justice (“ECJ”) has published a judgement, in the case of Orange România SA (“Orange Romania“) v. Romania’s National Supervisory Authority for Personal Data (“ANSPDCP“). In this ruling, the ECJ held that where consent is provided in the form of contractual pre-ticked boxes, it is invalid.

Orange Romania is a provider of telecommunications services in Romania. In March 2018, the ANSPDCP imposed a fine on the company for collecting and storing data subjects’ identity documents without their express consent, as part of contracts that were concluded during that month.

According to the ANSPDCP, the contracts that were signed between Orange Romania and its customers contained a clause that stated that the customers have been informed of, and consent to the collection and storage of their identity documents. The box relating to these provisions has been pre-ticked by Orange Romania. Romania’s regional court has asked the ECJ opinion over the validity of the data subjects’ consent under such circumstances.

Under the General Data Protection Regulation (“GDPR“), data subjects’ consent for processing of their personal data must be freely given, specific, informed and unambiguous. The ECJ held that consent is not validly given in cases of silence, pre-ticked boxes or inactivity.

The ECJ highlighted the importance of data controllers’ ability to demonstrate the existence of valid consent of its data subjects, as part of the principles of lawfulness of processing and accountability. In this regard, the ECJ found pre-ticked boxes to be an insufficient method for establishment of evidences of valid consent.

The ECJ concluded that if a written contract concerns various matters, then in order to ensure the data subjects’ freedom of choice, a declaration relating to processing of personal data must be presented in an intelligible and easily accessible form, using clear and plain language. In addition, the contractual terms must not mislead data subjects with regard their possibility to conclude a contract, despite their refusal of the processing. The contract between Orange Romania and its customers did not provide specific details on such possibility.

Orange Romania has also required its data subjects to actively declare their refusal in writing. According to the ECJ, such practice has an adverse effect on the data subjects’ freedom to choose to refuse the processing of their personal data. The court held that Orange Romania’s practice in this regard contradicts its obligation to demonstrate data subjects’ active consent, and therefore it is not allowed to require active expression of refusal.

This recent judgement is confirms previous regulatory guidance, and is aligned with the ECJ’s ruling last year in the case of Planet49, where it held that pre-ticked check boxes authorizing the use of cookies and similar technologies do not constitute a valid consent.

These developments demonstrate the importance of compliant collection of data subjects’ consent and accurate disclosures, as well as the regulatory scrutiny over practices that are deemed invalid.

********************

Feel free to contact us with any further question or comments regarding the update and subjects detailed above.

Kind regards,

Ariel Yosefi, Partner

Head of Technology & eCommerce Regulation

Herzog Fox & Neeman