A contract for the provision of telecommunications services containing a clause stating that the customer has consented to the collection and storage of his or her identity document cannot demonstrate that that customer has validly given his or her consent where the box referring to that clause has been ticked by the data controller before the contract was signed
That is also the case where the customer is misled as to the possibility of concluding the contract if he or she refuses to consent to the processing of his or her data, or where the freedom to choose to object to that collection and storage is affected by the requirement to complete an additional form setting out that refusal
Orange România SA is a provider of mobile telecommunications services on the Romanian market. On 28 March 2018, the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP) (the National Authority for the Supervision of Personal Data Processing), imposed a fine on it for collecting and storing copies of its customers’ identity documents without their express consent.
According to that ANSPDCP, between 1 and 26 March 2018, Orange România had concluded contracts for the provision of mobile telecommunications services which contain a clause stating that customers have been informed of, and have consented to, the collection and storage of a copy of their identity documents for identification purposes. The box relating to that clause had been ticked by the data controller before the contract was signed.
It is in that context that the Tribunalul București (Regional Court, Bucharest, Romania) requested the Court of Justice to specify the conditions in which the customers’ consent to the processing of personal data may be considered valid.
By its judgment today, the Court notes, first of all, that EU law1 provides for a list of the cases in which the processing of personal data can be regarded as being lawful. In particular, the data subject’s consent must be freely given, specific, informed and unambiguous. In that regard, consent is not validly given in the case of silence, pre-ticked boxes or inactivity.
In addition, if the data subject’s consent is given in the context of a written declaration which also concerns other matters, that declaration must be presented in an intelligible and easily accessible form, using clear and plain language. In order to ensure that the data subject enjoys genuine freedom of choice, the contractual terms must not mislead him or her as to the possibility of concluding the contract even if he or she refuses to consent to the processing of his or her data.
The Court points out that since Orange România is the controller of personal data, it must be able to demonstrate the lawfulness of the processing of those data and therefore, in the present case, the existence of the valid consent of its customers. In that regard, given that the customers concerned do not appear to have themselves ticked the box relating to the collection and storage of copies of their identity documents, the mere fact that that box was ticked is not such as to establish a positive indication of their consent. It is for the national court to carry out the necessary investigations to that end.
According to the Court, it is also for the national court to assess whether or not the contractual terms at issue were capable of misleading the customers concerned as to the possibility of concluding the contract notwithstanding a refusal to consent to the processing of their data, in the absence of specific details on that possibility. In addition, where a customer refuses to consent to the processing of his or her data, the Court points out that Orange România required him or her to declare in writing that he or she did not consent to a copy of his or her identity document being collected or stored. According to the Court, such an additional requirement is liable to affect unduly the freedom to choose to object to that collection and storage. In any event, since Orange România was required to establish that its customers have, by active behaviour, given their consent to the processing of their personal data, it cannot require them actively to express their refusal.
The Court therefore concludes that a contract for the provision of telecommunications services which contains a clause stating that the data subject has been informed of, and has consented to, the collection and storage of a copy of his or her identity document for identification purposes is not such as to demonstrate that that person has validly given his or her consent to that collection and storage, where the box referring to that clause has been ticked by the data controller before the contract was signed, where the terms of that contract are capable of misleading the data subject as to the possibility of concluding the contract in question even if he or she refuses to consent to the processing of his or her data, or where the freedom to choose to object to that collection and storage is unduly affected by that controller, in that it requires that the data subject, in order to express his or her refusal to consent to such processing, must complete an additional form setting out that refusal.
1 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ 2016 L 119, p. 1)
