Opinion of Advocate General Szpunar in Orange Romania

• Jurisdiction: European Union
• Court: Court of Justice (European Union)
• ECLI: ECLI:EU:C:2020:158
• Date: 04 March 2020

Provisional text

OPINION OF ADVOCATE GENERAL

SZPUNAR

delivered on 4 March 2020(1)

Case C‑61/19

Orange România SA

v

Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

(Request for a preliminary ruling from the Tribunalul Bucureşti (Regional Court, Bucharest, Romania))

(Preliminary reference — Directive 95/46/EC — Regulation (EU) 2016/679 — Protection of individuals with regard to the processing of personal data and the free movement of such data — Mobile telecommunication services — Concept of consent of the data subject — Indication of specific and informed wishes — Declaration of consent by means of a tick box — Burden of proof)

1. The present request for a preliminary ruling from the Tribunalul Bucureşti (Regional Court, Bucharest, Romania) stems from a dispute between a provider of telecommunication services and a national data protection authority as to the obligations of the former in the context of contractual negotiations with a customer when it comes to copying and storing the copy of an ID card.

2. It will provide the Court with the opportunity to further clarify the concept of ‘consent’ of a data subject, a central feature of EU data protection law, which is ultimately rooted in the fundamental right to data protection. In this connection, the Court should also address the question of the burden of proof as to whether or not the data subject has given consent.

Legal framework

EU law

Directive 95/46/EC

3. Pursuant to Article 2(h) of Directive 95/46/EC, (2) for the purposes of that directive, ‘“the data subject’s consent” shall mean any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed’.

4. Chapter II of that directive deals with general rules on the lawfulness of the processing of personal data.

5. Article 6 of the same directive, on ‘principles relating to data quality’, (3) is worded as follows:

‘1. Member States shall provide that personal data must be:

(a) processed fairly and lawfully;

(b) collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes. Further processing of data for historical, statistical or scientific purposes shall not be considered as incompatible provided that Member States provide appropriate safeguards;

(c) adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed;

…

2. It shall be for the controller to ensure that paragraph 1 is complied with.’

6. Article 7 of Directive 95/46 deals with ‘criteria for making data processing legitimate’. (4) According to that provision:

‘Member States shall provide that personal data may be processed only if:

(a) the data subject has unambiguously given his consent; or

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; ...

...’

Regulation (EU) 2016/679

7. Pursuant to Article 4(11) of Regulation (EU) 2016/679, (5) for the purpose of that regulation, ‘“consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her’.

8. Article 6(1)(a) and (b) of that regulation is worded as follows:

‘Processing shall be lawful only if and to the extent that at least one of the following applies:

(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’.

9. Article 7(1) of the same regulation states that ‘where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data’.

Romanian law

10. The legea nr. 677/2001 pentru protecția persoanelor cu privire la prelucrarea datelor cu caracter personal și libera circulație a acestor date (Law No 677/2001 on the protection of persons with regard to the processing of personal data and on the free movement of such data; ‘Law No 677/2001’) (6) sets out to transpose the provisions of Directive 95/46 into national law.

11. Article 32 of that law reads as follows:

‘The processing of personal data by a controller, or by a person mandated by him, in breach of the provisions of Articles 4 to 10 or without due regard to the rights provided for in Articles 12 to 15 or Article 17, shall constitute an administrative offence unless it is carried out in such circumstances as to constitute a criminal offence, and shall be penalised by a fine of between 10 000 000 old lei [1 000 Romanian lei (RON)] and 250 000 000 old lei [RON 25 000].’

Facts, procedure and questions referred

12. Orange România SA is a provider of mobile telecommunication services on the Romanian market, offering services both under the ‘PrePay’ system (7) and pursuant to the conclusion of a service contract. (8)

13. On 28 March 2018, the Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (National Authority for the Supervision of the Processing of Personal Data, Romania; ‘the ANSPDCP’), on the basis of Article 32 of Law No 677/2001, read in conjunction with Article 8 of that law, issued a report which included the imposition of an administrative penalty on Orange România on the ground that copies of the identity documents of its customers had been taken and kept without their express consent.

14. In this respect, the ANSPDCP noted that Orange România had concluded paper-based contracts for the provision of mobile telecommunication services with individual customers at business premises and that copies of their identity documents were annexed to those contracts. The content of those contracts included, inter alia, a statement of the fact that the customer had been informed of and had consented to the collection and storage (by Orange România) of those copies and that the existence of the customers’ consent had been established by the insertion of crosses in boxes in the written documentation evidencing the contract.

15. The relevant passage of the contracts in question reads as follows:

‘A statement by the customer that:

(i) he has been informed, prior to concluding the contract, of the chosen tariff plan, the applicable tariffs, the minimum duration of the contract, the conditions for terminating [the contract] and the terms for obtaining and using the services, including the area covered by the services, in accordance with Article 11 of ANCOM [the National Authority for Management and Regulation in Communications] Decision No 158/2015 and with O.U.G. v [No] 34/2014 (Legislative Decree No 34/2104), and of his right unilaterally to terminate the contract, which may be exercised pursuant to Article 1.17 of the General Terms and Conditions;

(ii) Orange România has provided the customer with all the necessary information to enable him to give his non-defective, express, free and specific consent to the conclusion and express acceptance of the contract, including all the contractual documentation, the General Terms and Conditions and the Brochure of Tariffs and Services;

(iii) he has been informed of and has consented to the following:

the processing of personal data for the purposes referred to in Article 1.15 of the General Terms and Conditions;

the keeping [by Orange] of copies of documents containing personal data for the purposes of identification;

the agreement to the processing of personal data (contact number and email) for direct marketing purposes;

the agreement to the processing of personal data (contact number and email) for market research purposes;

I have read and expressly agree to the keeping of documents containing personal data relating to state of health;

the data referred to in Article 1.15(10) of the General Terms and Conditions are not included in subscriber information and subscriber directory services.’

16. According to the ANSPDCP, Orange România has failed to prove that customers made an informed choice as to the collection and storage of the copies of their identity papers.

17. Orange România brought an action against the fine of 28 March 2018 before the referring court.

18. According to the findings of the referring court, there are contracts in which the choice freely expressed by the customer as regards the retention of a copy of his or her identity document is indicated by the insertion of a cross in a box, as well as contrary cases in which the customers have refused to express such agreement. It would appear from Orange România’s ‘internal procedures’ for selling that, in the latter cases, Orange România introduced the necessary information regarding the customer’s refusal to keep a copy of the identity document by completing a specific form to this effect and then concluded the contract. Thus, despite the indications contained in the Orange România’s general terms and conditions, Orange România did not refuse to conclude subscription contracts with customers, even when they refused to consent to the retention of a copy of their identity card.

19. The referring court considers that, in these circumstances, it is particularly important for the Court to rule on the criteria for determining whether consent is ‘specific’ and ‘informed’ and, where appropriate, on the probative value of the signature of contracts such as those at issue in the main proceedings.

20. It is in these circumstances that, by order of 14 November 2018, received at the Court on 29 January 2019, the Tribunalul Bucureşti (Regional...