The present case (Rs. C‑61/19) concerns a legal dispute between Orange România SA (a telecommunications provider) and the Romanian data protection authority. At issue was the Consent in the creation and retention of a Copy of ID in connection with contract negotiations with customers. The GTC of the provider for mobile phone contracts stated that the customer had been informed about several points and had given his consent, including the creation and retention of a copy of his ID.
The supervisory authority was of the opinion that there was a lack of a effective consent. The Bucharest Regional Court therefore referred the following questions to the ECJ:
1. what conditions must be fulfilled within the meaning of Article 2(h) of Directive 95/46 in order for a declaration of intent to be regarded as a for the specific case and in knowledge of the facts can be considered to have taken place?
2. what conditions must be fulfilled within the meaning of Article 2(h) of Directive 95/46 in order for a declaration of intention to be regarded as Without coercion can be considered to have taken place?
The Advocate General proposesto answer these questions as follows:
A data subject who intends to enter into a contractual relationship with a company for the provision of mobile communications services does not give the company “consent,” i.e., expresses not “without constraint, for the specific case and in Knowledge of the facts“their will, within the meaning of Article 2(h) of the [Data Protection Directive] and Article 4(11) of the [GDPR], if it is based on an otherwise standardized contract must declare handwritten, that they have Consent in making and keeping photocopies of their identity documents denied.
As part of the reasoning, the Advocate General states, inter alia, the following:
- The ECJ has ruled in the Planet49 decision recognized that a pre-ticked checkbox does not lead to consent. This applies equally to the analog world: Preset checkboxes mean No active consent of the person signing the document: “The situation is not free of doubt. The text may or may not have been read. The “reader” may have forgotten to do so out of sheer carelessness; it is therefore impossible to determine clearly whether the consent was given voluntarily”.
- The burden of proof for consent lies with the person responsible; “any doubts as to the giving of consent by the data subject must be resolved by evidence to be provided by the data controller”.