CJEU DECISION ON CASE ORANGE ROMANIA SA V ROMANIAN DPA CASE

12.11.2020

The Court of Justice of the European Union (“CJEU”) has made decision on Orange Romania SA v the National Authority for the Supervision of Personal Data Processing case no C-61/19 where the Company was claimed to collect personal data without valid consent.

In the present case, Orange Romania Sa which is a provider of mobile telecommunications services was fined by the National Authority for the Supervision of Personal Data Processing (“DPA”) for collecting and storing copies of its customers’ identity documents without their express consent. According to the DPA’s investigation Orange România had concluded contracts for the provision of mobile telecommunications services which contain a clause stating that customers have been informed of, and have consented to, the collection and storage of a copy of their identity documents for identification purposes. The box relating to that clause had been ticked by the data controller before the contract was signed.

By CJEU’s judgment today requested by the Tribunalul București, it is stated that the data subject’s consent must be freely given, specific, informed and unambiguous. In that regard, consent is not validly given in the case of silence, pre-ticked boxes or inactivity.

In this context, the Court concluded that a contract for the provision of telecommunications services containing a clause stating that the customer has consented to the collection and storage of his or her identity document cannot demonstrate that that customer has validly given his or her consent where the box referring to that clause has been ticked by the data controller before the contract was signed.

You can reach the full text of the decision here.

Should you have any queries and/or remarks, please do not hesitate to contact us. 

Kind regards,

Zumbul Attorneys-at-Law

info@zumbul.av.tr