CJEU, judgment of 11 November 2020, C-61/19, Orange România

1 Overview

Orange România, a Romanian mobile telephony provider, required its customers, when concluding a contract, to agree to the collection and storage of copies of their identity documents. The declaration of agreement was placed in a pre-formulated contract form alongside other clauses; in some instances the staff themselves ticked the corresponding boxes. The Romanian data protection supervisory authority imposed a fine; the dispute reached the Court of Justice by way of a reference for a preliminary ruling.

2 Headnotes

Consent to the processing of personal data is not valid unless it is based on an active, informed and freely given indication of the data subject's wishes. Pre-ticked boxes, silence or inactivity do not suffice (paras. 36 et seq.).

A declaration of consent that forms part of a pre-formulated contract and is combined with further contractual terms must be clear, precise and distinguishable from the other matters of the contract. The data subject must be able to discern that they are expressly agreeing to the processing and what the scope of that agreement is (paras. 38 et seq.).

The controller bears the burden of proving that the data subject has consented. Contractual clauses which presuppose such consent are not sufficient on their own where it is not apparent that the data subject made an active choice (para. 52).

3 Significance

The decision gives concrete shape to the validity requirements of Article 4(11) and Article 7 GDPR in the context of pre-formulated contracts and standard terms and conditions. It draws a clear line between contractual declarations of agreement and consent within the meaning of data protection law, and it is of practical significance for every business model that collects consent in standard-form contracts. The decision forms part of a line of case law that began with Planet49 and was continued in Meta Platforms/Bundeskartellamt.