On 11 November 2020, the Court of Justice of the European Union (CJEU) issued its decision in the case Orange Romania SA v. The Romanian National Supervisory Authority for the Processing of Personal Data (Romanian DPA). This decision significantly raises the standards of consent, as we will explain in this article. It will be a challenge for businesses to update their consent collection practices in order to meet the CJEU’s requirements regarding the active, freely-given, and informed nature of consent. Also, this decision is relevant for data subjects and consumers who want to know more about their rights relating to businesses unfair practices of collecting consent.
The dispute in the main proceedings
Orange Romania provides mobile telecommunications services on the Romanian market. On 28 March 2018, the Romanian DPA a fine on Orange Romania for storing copies of customers’ identity documents without demonstrating that those customers had given their valid consent.
Orange Romania disagreed and brought an action against Romanian DPA’s decision before the Tribunalul Bucureşti (Regional Court, Bucharest, Romania).
The Romanian court found that in some contracts concluded between Orange Romania and individuals, the tick box for consenting to identity documents’ storage was activated. In contrast, in other contracts, this was not the case. The court established that Orange Romania, on the one hand, did not refuse to conclude contracts in the absence of the consumer’s consent to the storage of identity documents, but, on the other hand, forced its customers to complete another form designed to specify their refusal to consent.
Faced with this situation, the Romanian referring court was uncertain of two things. Firstly, the court raised the question of whether, in those circumstances, the customer’s consent to the collection of their identity documents was valid. Secondly, the court wondered whether the signing of a contract with a clause on the storage of copies of documents containing personal data for identification purposes can prove the existence of such consent.
The Romanian court decided to stay the proceedings and address two questions to the CJEU regarding the necessary conditions for consent to be specific, informed, and freely given.
The CJEU’s ruling in Orange Romania
The CJEU answered the two referring questions as follows (para. 52): (i) the controller shall be able to demonstrate that the data subject has consented by an active behaviour to processing of his or her data; (ii) the controller shall be able to demonstrate that the data subject was informed about all the circumstances surrounding the processing, in an intelligible and easily accessible form, using clear and plain language; (iii) the method of providing information used by the controller shall allow that person to easily understand the consequences of the consent so that it is given with full knowledge of the facts.
Further, CJEU (para. 52) stated that ‘a ontract for the provision of telecommunications services which contains a clause stating that the data subject has been informed of, and has consented to, the collection and storage of a copy of his or her identity document for identification purposes is not such as to demonstrate that that person has validly given his or her consent, as provided for in those provisions, to that collection and storage, where:
– the box referring to that clause has been ticked by the data controller before the contract was signed, or where
– the terms of that contract are capable of misleading the data subject as to the possibility of concluding the contract in question even if he or she refuses to consent to the processing of his or her data, or where
– the freedom to choose to object to that collection and storage is unduly affected by that controller in requiring that the data subject, in order to refuse consent, must complete an additional form setting out that refusal.’
Article 4 (11) GDPR defines consent as ‘any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’. In other words, in order to be valid, the consent shall meet, cumulatively, several standards, including (i) a requirement of free will; (ii) a requirement of specificity; (iii) a requirement of an informed consent, given with full knowledge of the facts; (iv) a requirement of unambiguity; and (v) a requirement of an active behaviour on the part of the data subject.
In a previous case, Planet49 , the Grand Chamber of the CJEU ruled on the active and unequivocal nature of consent, establishing that consent is not valid when given by way of a pre-checked checkbox that the user must deselect to refuse his or her consent (para. 65). Furthermore, the CJEU stated that the possibility of unchecking the box is not an active action but a passive one. The CJEU’s ruling in Planet49 is on the same wavelength as Recital (32) GDPR, which stipulates that ‘silence, pre-ticked boxes or inactivity should not, therefore, constitute consent’.
In Orange Romania, the CJEU goes further and sheds some light on the concept of consent, analyzing the active, freely-given, and informed nature of consent.
As regards the active nature of consent, the CJEU states that the consent is not valid if the tick box attached has been checked by the data controller prior to the signing of that contract.
As regards the freely-given and informed nature of consent, in the CJEU’s point of view, the consent is not valid when the terms of the contract are capable of misleading the data subject as to the possibility of concluding the contract in question even if he or she refuses to consent to the processing of his or her data (para. 52). That being said, it is easy to understand how forcing customers to complete another form to specify their refusal to consent may lead data subjects to confusion, affecting their right to information and, eventually, affecting their free will. Although Article 29 Working Party had already shown that consent should not be a mandatory condition for the conclusion of a contract, the CJEU goes further and shows how the inclusion of additional conditions (in this case, the completion of an additional form) leads to the invalidity of consent. In conclusion, in Orange Romania, it seems that the CJEU attributes an absolute value to consen when used as a legal basis for processing and consequently, any restriction or formality, however small, could lead to the invalidity of consent.
In conclusion, the CJEU, in Orange Romania, significantly raises the standards of consent, insisting that the data subject should have absolute control when giving his or her consent. This case will undoubtedly have a significant influence in practice. It invites national courts to interpret consent to the highest standards, and companies should make further efforts to update their consent collection practices in order to meet the CJEU’s requirements.