On 1 October 2019, the European Court of Justice (ECJ) ruled on a number of preliminary questions addressed to it by the German Bundesgerichtshof regarding the concept of consent by a data subject to the processing of (personal) data by means of cookies and the duty of information incumbent on a service provider (Case C-673/17).
The judgment of the Court is in line with the opinion of Advocate General Szpunar of 21 March 2019.
Facts
Planet49, a German company, organized an online lottery. People who wished to participate had to fill in their name and address in an online form. The online form then contained two checkboxes and an “I participate”-button.
The first checkbox stated that the data subject agreed to his/her data being processed by sponsors and partners of Planet49 in order to keep him/her informed of similar offers. By clicking on a link in the text, the data subject was also able to choose which partners or sponsors she/he wanted to be contacted by and in what way. This checkbox was not pre-checked.
The second checkbox stated that the data subject agreed that Planet 49 would place cookies on the terminal equipment of participants after registration for participation in the lottery. The cookies would analyze the person's surfing behaviour, with a specialised web analysis company being able to send the data subject targeted advertising. However, this checkbox was pre-checked.
Participation in the lottery was only possible when the data subject had ticked the first checkbox.
Preliminary ruling questions
The Bundesgerichtshof asked the ECJ whether:
- it constitutes a valid consent within the meaning of Article 5(3) and Article 2(f) of Directive 2002/58 (hereafter “ePrivacy Directive”), read in conjunction with Article 2(h) of Directive 95/46 (hereafter ”Data Protection Directive”), if the storage of information, or access to information already stored in the user’s terminal equipment, is permitted by way of a pre-checked checkbox which the user must deselect to refuse his or her consent;
- it makes a difference (for the purposes of the above-mentioned legislation) whether the information stored or accessed constitutes personal data; and
- a valid consent within the meaning of Article 6(1)(a) GDPR exists in the circumstances referred to in the first question (pre-checked checkbox).It also asked what information the service provider has to give to the user in accordance with Article 5(3) of the ePrivacy Directive and whether this includes the duration of the operation of the cookies and whether third parties are given access to the cookies.
Assessment by the ECJ
The ECJ ruled that a pre-checked checkbox does not constitute a valid consent.
According to the Court, both sets of legislation (the ePrivacy Directive read in conjunction with the Data Protection Directive on the one hand and the GDPR on the other hand) require active behaviour to constitute consent.
Moreover, the ECJ states that the processing of data by means of cookies always requires the active consent of the data subject, regardless of whether or not personal data is involved.
Finally, the ECJ states that the information that the service provider must give to a website user includes the duration of the operation of cookies and whether or not third parties may have access to those cookies.
Conclusion
This decision is not surprising since it is was clear that an active consent was required.
The ECJ does not, however, rule on the freely given nature of the consent that is a more sensitive question with cookies banner.
It remains to be seen how the Data Protection Authorities will react and investigate further on the compliance of the cookies’ consent in the future. We already know that the Dutch and French Data Protection Authorities have recently issued new guidelines on this topic, and that these are very controversial in France.
Authors:
Bastiaan Bruyndonckx
bastiaan.bruyndonckx@lydian.be
Olivia Santantonio
olivia.santantonio@lydian.be
Ruben Van Breugel
ruben.vanbreugel@lydian.be
