In its judgment dated November 11th, the CJEU provides useful clarifications on the reasons for invalidity of consent for the collection and storage of personal data.

The judgment sounds like a reminder of the recommendations and guidelines of the French CNIL on the use of online cookies : consent must be a clear active behaviour, it cannot be inferred from the signing of a contract containing a pre-checked box by the data controller.

Similarly, as stated by the CNIL, refusing must be as easy as consenting, the refusal should not lead to additional formalities for the data subject.

The case before the Court concerns the appeal filed by Orange România, a mobile telecommunications services company, before the Court Bucureşti (Bucharest District Court), against the decision of the Romanian Data Protection Authority (ANSPDCP) of 28 March 2018, imposing sanctions on it for having kept copies of ID of its customers, without having demonstrated that they had expressed a valid consent. The Court Bucureşti decided to stay the proceedings and to refer a question to the CJEU for a preliminary ruling, which, in substance, concerns the interpretation of the provisions of articles 2. h) and 7. a) of Directive 95/46 and of articles 4. 11 and 6. 1. a) of the GDPR. 

The CJEU states that a contract for the provision of telecommunications services which contains a clause according to which the person concerned has been informed and has consented to the collection and storage of a copy of his or her ID for identification purposes, may not be likely to show that this person has validly given his or her consent to that collection and storage.

The Court specifies that consent is not valid when the said clause included a box pre-checked by the data controller. 

Consent is also invalid, according to the Court, when the contractual provisions are likely to mislead the data subject as regards the possibility of concluding the contract even if he refuses to consent to the processing of his data. 

The Court further clarifies that consent is not freely expressed when the choice to consent or to object to the collection of personal data is affected by the data controller, who requires the data subject, in order to express his or her refusal, to fill in an additional form stating this refusal. This point had been developed by the Advocate General, specifying that expressing a refusal of consent in handwritten form is a too heavy burden for the client, who should not feel that his or her refusal is not in accordance with the usual procedures.