A contract for the provision of telecommunications services containing a clause stating that the customer has consented to the collection and retention of a copy of his or her identity document cannot show that he or she has validly given his or her consent when the box expressing such consent has been ticked by the controller prior to the signing of the contract. This is, in substance, the judgment of the Court of Justice of the European Union (CJEU) of Wednesday 11 November in Case C-61/19.
With this judgment, the Court responds to a request for clarification made by the Bucharest General Court after the Romanian National Authority for the Supervision of Personal Data Processing imposed a fine on Orange România SA, a telecommunications service provider, on the ground that it had collected and kept copies of its customers’ identity documents without their express consent.
While the contract at the source of the dispute does contain a clause according to which customers of Orange România SA have provided such consent, the box relating to this clause was ticked by the controller before the contract was signed.
In its judgment on Wednesday, the CJEU ruled that the mere fact that this box was ticked is not sufficient to establish consent.
It does so on the basis of the European Directive (95/46) on the processing of personal data, which provides that consent is not validly given in the case of silence, boxes ticked by default, or inactivity.
The Court further specified that consent is not validly given where the contractual stipulations are liable to mislead the consumer as to the possibility of concluding the contract even if he or she refuses to consent to the processing of his or her data or where the free choice to oppose the collection and storage of a copy of his or her identity document is affected by the requirement of an additional form expressing that refusal.
See the judgment: https://bit.ly/3lrE4wd (Original version in French by Damien Genicot)