Orange România SA is a mobile telecommunications services provider in Romania. On 28 March 2018, the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) (the Romanian Data Protection Authority), fined Orange România for collecting and storing copies of its customers’ identification documents without their express consent.

According to ANSPDCP, between 1 and 26 March 2018 Orange România had concluded contracts for the provision of mobile telecommunications services that contained a clause stating that customers had been informed of, and had consented to, the collection and storage of a copy of their identification documents. The box relating to that clause had been pre-ticked by the data controller before the contract was signed.

The Regional Court, Bucharest, Romania asked the CJEU:

1. which conditions must be fulfilled in order for an indication of wishes to be regarded as specific and informed; and
2. which conditions must be fulfilled in order for an indication of wishes to be regarded as freely given.

In the circumstances of this particular case, the CJEU said that it would rule on the issue of consent under both the Data Protection Directive (95/46/EC) and the GDPR.

The CJEU noted that both the Directive and the GDPR set out a list of the situations in which the processing of personal data is regarded as being lawful. In particular, the data subject’s consent must be freely given, specific, informed and unambiguous, and consent is not validly given in the case of silence, pre-ticked boxes or inactivity.

In addition, the CJEU said, if the data subject’s consent is given in the context of a written declaration, which also covers other matters, that declaration must be presented in an intelligible and easily accessible form, using clear and plain language. In order to ensure that the data subject enjoys genuine freedom of choice, the contractual terms must not mislead as to the option of concluding the contract even if he or she refuses to consent to the processing of his or her data.

The CJEU said that since Orange România was the data controller, it had to demonstrate the lawfulness of the processing of that data: in this case, the existence of valid consent from its customers. Given that the customers concerned did not appear to have ticked the box relating to the collection and storage of copies of their identification documents themselves, the mere fact that that box had been ticked did not establish a positive indication of their consent. It was for the national court to carry out the necessary investigations to that end.

It was also for the national court, the CJEU said, to assess whether or not the contractual terms in question were capable of misleading customers as to the option of concluding the contract despite not consenting to the processing of their data.

In addition, the CJEU noted that where a customer refused to consent, Orange România required him or her to declare in writing that he or she did not consent. In the CJEU’s view, this additional requirement was liable to affect unduly the freedom to choose to object to the processing of their data. In any event, since the onus was on Orange România to establish that its customers had actively given their consent to the processing of their personal data, it was not sufficient to require them actively to express their refusal.

The CJEU concluded that a contract for the provision of telecommunications services that contained a clause stating that the data subject had been informed of, and had consented to, the collection and storage of a copy of his or her identification document did not demonstrate that that person had validly given his or her consent to that collection and storage, where: (i) the box referring to that clause had been ticked by the data controller before the contract was signed; (ii) the terms of that contract misled the data subject as to the option of concluding the contract notwithstanding a refusal to consent; or (iii) the freedom to choose to object was unduly affected by the data controller by requiring the data subject to complete an additional form to express any refusal to consent. (Case C-61/19 Orange România SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal EU:C:2020:901 (11 November 2020) — to read the judgment in full, click here).