By its decision, the Romanian supervisory authority (“ANSPDCP”) imposed a fine against Orange România for storing copies of customers’ identity documents without demonstrating that those customers had given their valid consent.
Orange România referred to its contracts where customers gave their consent to storing the identity documents by signing the agreements upon been provided with necessary information included in the agreement text.
In the decision, the ANSPDCP stated that Orange România had concluded contracts for the provision of telecommunications services with data subjects and that copies of those data subjects’ identity documents were annexed to those contracts. According to the ANSPDCP, Orange România had not proven that the data subjects whose identity documents had been copied and annexed to their contracts had given their valid consent to the collection and storage of copies of their identity documents.
Orange România brought an action against the decision before the Tribunalul Bucureşti (Regional Court, Bucharest, Romania) which referred the case to the Court of Justice of the European Union (“CJEU”) asking a preliminary ruling for the following questions:
- For the purposes of Article 2(h) of Directive 95/46, what conditions must be fulfilled in order for an indication of wishes to be regarded as ‘specific’ and ‘informed’?
- For the purposes of Article 2(h) of Directive 95/46, what conditions must be fulfilled in order for an indication of wished to be regarded as ‘freely given’?
The CJEU concluded that it is appropriate to answer those questions on the basis of both Directive 95/46 and the General Data Protection Regulation (“GDPR”) as the GDPR is applicable ratione temporis in the case.
The CJEU ruled that consent must be interpreted in a way that it is for the data controller to demonstrate that the data subject has, by active behaviour, given his or her consent to the processing of his or her personal data and that all relevant information needed to understand the consequences of that consent has been provided beforehand in an intelligible and easily accessible form, using clear and plain language.
In its decision, the CJEU found that a contract containing provisions stating that the data subject has been informed of, and has consented to, the collection and storage is not enough to demonstrate a valid consent has been given where:
- the box referring to that clause is pre-ticked by the data controller before the contract is signed, or where
- the terms of the agreement are capable of misleading the data subjects, or where
- the freedom to choose to object to that collection and storage is unduly affected by the controller, in requiring that the data subjects, in order to refuse consent, must complete an additional form setting out that refusal.
See the CJEU’s decision in case C-61/19 here.