Pre-Ticked Consent Invalid, European Court Of Justice Rules

Pre-Ticked Consent Invalid, European Court Of Justice Rules

The European Court of Justice (ECJ) has ruled in the Orange România SA ("Orange Romania") v. Romania's National Supervisory Authority for Personal Data ("ANSPDCP") case that where given in the form of contractual pre-ticked boxes, consent is invalid.

In March 2018, the ANSPDCP slapped a fine on Romanian telecommunications service provider Orange for collecting and storing identity documents of data subjects sans their express consent.

A clause in the contracts signed between Orange and its customers said that the latter had been informed about and agreed to the collection and storage of their identity documents, as per ANSPDCP. Orange had preticked the box relating to these provisions. The ECJ's views have been sought by Romania's regional court on the validity of the data subjects' consent in these circumstances. The data subjects' consent for personal data processing has to be freely given, informed, specific and unambiguous under the General Data Protection Regulation (GDPR). In case of pre-ticked boxes, inactivity or silence, consent was not valid, the ECJ held.

In a written contract dealing with various issues, that the data subject has freely given consent must be indicated vide an intelligible and easily accessible declaration about processing of personal data presented in plain and clear language, the ECJ said. The ECJ disallowed Orange to ask data subjects to declare in writing their refusal to process personal data.